Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace
CVE-2026-82406
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function c
2026-09-24 归档
今日共收录 1600 条安全情报，包含 683 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
CVE-2026-93421
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /_
s2s-proxy accepts untrusted client certificates
CVE-2026-96770
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
CVE-2026-77602
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
CVE-2026-77601
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
Jawn: Uncontrolled nesting depth in JSON parser
CVE-2026-59990
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nes
Jawn: Quadratic parsing effort in AsyncParser
CVE-2026-61814
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON tok
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
CVE-2026-76087
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submi
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
CVE-2026-76086
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings
Formie: Missing authorization on sent notification resend modal exposes submission PII
CVE-2026-76089
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-rese
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
CVE-2026-92692
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affe
JLine: ReDoS in Built-in Less Viewer Search
CVE-2026-77423
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer p
JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
CVE-2026-77420
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(Str
JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
CVE-2026-77422
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command
JLine: ReDoS in Nano Editor Regex Search Mode
CVE-2026-77421
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's
LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name
CVE-2026-92730
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey
GoCD is vulnerable to authorization bypass via pipeline structure API
CVE-2026-55632
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompleti
GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API
CVE-2026-52744
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API a
Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation
CVE-2026-77281 · CVE-2026-92284 · CVE-2026-92700
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fil
Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS
CVE-2026-77281 · CVE-2026-92700 · CVE-2026-92284
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/rep