A flaw was found in the automation-controller API. The unauthenticated health...
CVE-2026-84712
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/p
2026-09-24 归档
今日共收录 1600 条安全情报，包含 683 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表A flaw was found in the automation-controller input-validation guard...
CVE-2026-84714
A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function us
A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential...
CVE-2026-84706
A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view...
CVE-2026-84683
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command,
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before...
CVE-2026-68492
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information...
CVE-2026-68490
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other acc
A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This...
CVE-2026-96548
A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown par
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2,...
CVE-2026-96770
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use
Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia...
CVE-2026-96872
Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLa
A vulnerability has been found in sfturing hosp_order up to...
CVE-2026-96549
A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A...
CVE-2026-95602
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploitin
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
CVE-2026-95604
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a...
CVE-2026-96546
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompre
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted...
CVE-2026-96545
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that ca
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace
CVE-2026-82406
**Location:** `core/kapp/market/market.go` — `Buy()` (approx. L281–436)\ **Severity:** High The native marketplace enfo
Formie: Missing authorization on sent notification resend modal exposes submission PII
CVE-2026-76089
### Impact The control panel action `formie/sent-notifications/get-resend-modal-content` (`SentNotificationsController:
Jawn: Quadratic parsing effort in AsyncParser
CVE-2026-61814
`AsyncParser` can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across
Jawn: Uncontrolled nesting depth in JSON parser
CVE-2026-59990
The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input. ### Impact A remote atta
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller
CVE-2026-82405
### Description The VM built-in function `KleverUpdateAccountPermission` (registered always-active, `creator.go:381-390
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
CVE-2026-86065
## Summary The unauthenticated WebSocket endpoint `GET /subscribe` is registered `open: true` by default (`config/node/a