Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.
CVE-2026-24073
Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.
2026-09-18 归档
今日共收录 2436 条安全情报，包含 1258 个 CVE，779 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Memory Corruption when copying large input data exceeds normal allocation limits.
CVE-2025-59607
Memory Corruption when copying large input data exceeds normal allocation limits.
Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’...
CVE-2026-92839
Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the applicat
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, ...
CVE-2026-86311
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scrip
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES en...
CVE-2026-50603
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1w...
CVE-2026-89064
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versi
A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search ...
CVE-2026-92838
A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or
The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based bu...
CVE-2026-81546
The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when pa
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credent...
CVE-2026-65388
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the atta
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the Live...
CVE-2026-61599
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization (`get_obj...
CVE-2026-61596
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRunt...
CVE-2026-61589
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than st...
CVE-2026-92598
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes ...
CVE-2026-92597
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a commen
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a ...
CVE-2026-92596
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows re
Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remained unsa...
CVE-2026-92593
Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirec
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signe...
CVE-2026-92592
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun c
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate...
CVE-2026-92591
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths...
CVE-2026-92588
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endp
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to p...
CVE-2026-92586
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the se