Saleor throttling.py get_client_ip excessive authentication
CVE-2026-93650
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function
2026-09-19 归档
今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。
← 返回归档列表deepmerge through 4.3.1 Prototype Poisoning via mergeObject
CVE-2026-93753
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properl
source-map-js through 1.2.1 Event Loop Denial of Service
CVE-2026-93749
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attacke
SysReptor: Unauthorized file disclosure by broken access control in writable shared notes
CVE-2026-81182
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a
SysReptor: Authenticated RCE by insecure image processing
CVE-2026-81180
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Profess
SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity
CVE-2026-81178
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public no
Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)
CVE-2026-71537
Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Se
Moquette: Missing Authorization in io.moquette:moquette-broker
CVE-2026-85058
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last W
Perses: Unvalidated project parameter enables filesystem path traversal
CVE-2026-63445
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoint
Perses project query parameter authorization bypass exposes cross-project resources
CVE-2026-63458
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenti
Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware
CVE-2026-32641
Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/ht
c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
CVE-2026-69184
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression poi
c-ares: Memory-amplification denial of service via unvalidated DNS header record counts
CVE-2026-69186
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NS
Icinga 2 DSL Injection via Unescaped Import Template Name
CVE-2026-61552
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes atta
Icinga 2: Stack overflow via deeply nested JSON objects
CVE-2026-61551
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaus
Icinga 2: Improper access control for JSON-RPC update certificate messages
CVE-2026-61550
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC mes
Kyoo: Transcoder serves uncataloged files from the media directory
CVE-2026-77385
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
CVE-2026-33625
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 conta
LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory
CVE-2026-62278
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authen
LubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership Check
CVE-2026-62279
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an aut