froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
CVE-2026-100712
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET r
2026-09-27 归档
今日共收录 1038 条安全情报，包含 222 个 CVE，481 篇安全通告，以及 74 篇研究论文。
← 返回归档列表froxlor before 2.3.12 Authentication Bypass via Session Persistence
CVE-2026-100711
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user p
Froxlor before 2.3.12 DKIM Private Key Disclosure via API
CVE-2026-100710
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDoma
Froxlor before 2.3.12 2FA Bypass via Namespace Confusion
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the a
Froxlor before 2.3.13 Private Key Disclosure via Certificates API
CVE-2026-100708
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in t
Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path
CVE-2026-100707
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources
kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
CVE-2026-100706
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace
Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass
CVE-2026-100704
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyvern
Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib
CVE-2026-100703
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it
Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
CVE-2026-100702
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, all
nodemailer before 10.0.6 Denial of Service via addressparser
CVE-2026-100700
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex patter
Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment
CVE-2026-100699
Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser)
Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex
CVE-2026-100698
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/f
Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver
CVE-2026-100697
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.
Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver
CVE-2026-100696
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the option
Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
CVE-2026-100695
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpol
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
CVE-2026-100693
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-litera
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
CVE-2026-100692
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopp
Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
CVE-2026-100690
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.j
GitPython before 3.1.62 Path Traversal via gitmodules path
CVE-2026-100689
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodu