IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to...
CVE-2026-11727
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service
2026-09-19 归档
今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。
← 返回归档列表IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted...
CVE-2026-17619
IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which co
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain...
CVE-2026-11726
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or c
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a...
CVE-2026-11716
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or pote
IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive...
CVE-2026-11540
IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the fil
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP...
CVE-2026-11548
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vuln
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This...
CVE-2026-93650
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function
IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due...
CVE-2026-11710
IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive...
CVE-2026-11545
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the admi
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
CVE-2026-71537
### Summary The service downgrade implementation in `app/Livewire/Services/Upgrade.php::doUpgrade()` executes a prorati
io.moquette:moquette-broker has a Missing Authorization issue
CVE-2026-85058
## Summary Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testam
Perses's unvalidated project parameter enables filesystem path traversal
CVE-2026-63445
### Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the re
Perses's missing authorization in datasource proxy allows cross-scope secret disclosure
CVE-2026-63199
### Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret na
Perses's project query parameter authorization bypass exposes cross-project resources
CVE-2026-63458
### Impact _What kind of vulnerability is it?_ An authenticated user who is only a viewer on project team-a requests GE
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
CVE-2026-91127
### Summary Before 2.3.1, the legacy `.doc` renderer emitted document hyperlink targets after HTML escaping but without
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
CVE-2026-77301
### Summary adm-zip allocates an entry's output buffer from the declared uncompressed size (central-directory `size` fie
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
CVE-2026-81505
## Summary frain-dev/convoy (all versions up to and including v26.6.2, no patch available) lets any authenticated caller
md-editor-v3: XSS via fenced-code language rendering bypass
CVE-2026-84992
### Summary `MdPreview` interpolates a fenced-code language into HTML attributes without escaping it. A crafted info str
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
CVE-2026-63349
AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process()
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
CVE-2026-63374
### Impact Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made