mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh...
CVE-2026-102367
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to
2026-09-29 归档
今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。
← 返回归档列表mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController...
CVE-2026-102365
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer a
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront...
CVE-2026-102364
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authentica
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController...
CVE-2026-102363
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing...
CVE-2026-102334
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers t
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted...
CVE-2026-101277
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the functio
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators,...
CVE-2026-102335
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin use
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive...
CVE-2026-102332
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as...
CVE-2026-102333
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web
mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in...
CVE-2026-102362
mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Un
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController...
CVE-2026-102297
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenti
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp:...
CVE-2026-102296
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow m
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view...
CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authentica
A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an...
CVE-2026-101203
A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the c
A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown...
CVE-2026-101202
A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component
A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown...
CVE-2026-101205
A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PC
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages...
CVE-2026-101092
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish r
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed...
CVE-2026-101091
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyu
A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function...
CVE-2026-101204
A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
CVE-2026-85024
## Impact undici's WebSocket client (including Node.js's bundled `globalThis.WebSocket`) crashes the entire Node.js pro