md-editor-v3: XSS via fenced-code language rendering bypass
CVE-2026-84992
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt()
2026-09-19 归档
今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。
← 返回归档列表PJSIP: Heap buffer overflow in the AVI parser
CVE-2026-77396
PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser
Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path
CVE-2026-92701
trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS (aTLS) Intel TDX
AnyIO process-pool workers can block indefinitely on undrained stderr
CVE-2026-64847
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Pri
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
CVE-2025-66455
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior
Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path
CVE-2026-92702
Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
CVE-2026-63349
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
CVE-2026-61833
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)
CVE-2026-77610
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's
Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data
CVE-2026-61548
Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseS
Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling
CVE-2026-55556
Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_aut
Semantic MediaWiki has an open redirect in Special:URIResolver
CVE-2026-77609
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets
CVE-2026-63406
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemet
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS
CVE-2026-77607
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's
AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body
CVE-2026-63405
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-
Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication
CVE-2026-93559
A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This aff
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
CVE-2026-77608
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
CVE-2026-77606
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
CVE-2026-77301
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEnt
Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
CVE-2026-61795
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnU