CVE-2026-102759
CVE-2026-102759
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secu
2026-09-30 归档
今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-102758
CVE-2026-102758
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data
CVE-2026-102757
CVE-2026-102757
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing,
Marmite through 0.4.2 Unauthenticated API Access via Development Server
CVE-2026-102811
Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmi
Marmite through 0.4.2 Path Traversal via Development Server
CVE-2026-102810
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows u
PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command
CVE-2026-102809
PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fail
PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress
CVE-2026-102808
PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byt
OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket
CVE-2026-102807
OpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-s
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
CVE-2026-102676
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
CVE-2026-102675
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
CVE-2026-102674
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6
Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
CVE-2026-102697
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bas
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
CVE-2026-102673
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4
SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room
CVE-2026-102634
SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /genera
libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
CVE-2026-102633
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit pl
Akaunting before 2.1.31 OS Command Injection via app alias
CVE-2022-51019
Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
CVE-2026-97711
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions.
UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host
CVE-2026-102630
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header wit
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
CVE-2026-97689
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.st
Timing Side-Channel in SM2 Signature Generation
CVE-2026-77696
Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channe