SQLBot through 1.10.1 Improper Access Control via Dashboard Update
CVE-2026-93660
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authe
2026-09-19 归档
今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Concrete CMS Community Store before 2.7.8 Stored XSS
CVE-2026-93659
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and a
uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid
CVE-2026-93658
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership
hickory-resolver before 0.26.2 DNSSEC Validation Bypass
CVE-2026-93657
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and R
ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint
CVE-2026-77928
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract
ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint
CVE-2026-77927
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read
CVE-2026-93019
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_pa
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p
CVE-2026-93018
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes pas
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species
CVE-2026-93606
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API
vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
CVE-2026-93605
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits chi
vm2 3.11.8 Sandbox Escape via crypto.setFips
CVE-2026-93604
vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allow
vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function
CVE-2026-93603
vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge
rustls-webpki before 0.103.10 CRL Revocation Check Bypass
CVE-2026-93602
rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares onl
rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass
CVE-2026-93601
rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorr
rustls webpki Name Constraints URI Validation Bypass
CVE-2026-93600
rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore
rustls-webpki before 0.103.13 Panic via empty BIT STRING
CVE-2026-93599
rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_str
ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle
CVE-2026-93598
ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot s
ArcadeDB before 26.9.1 ACL Bypass via query_database Tool
CVE-2026-93595
ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI
ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries
CVE-2026-93594
ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control ru
ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission
CVE-2026-93593
ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver b