Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
CVE-2026-95519
Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
2026-10-02 归档
今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
CVE-2026-95521
Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
CVE-2026-67410
RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
RabbitMQ: Trust-store whitelist by Issuer+Serial only
CVE-2026-67231
RabbitMQ: Trust-store whitelist by Issuer+Serial only
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
CVE-2026-93834
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram
CVE-2026-81627
Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram
sprintf-js through 1.1.3 Denial of Service via Unbounded Precision
CVE-2026-97058
sprintf-js through 1.1.3 Denial of Service via Unbounded Precision
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
CVE-2026-102277
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
CVE-2026-102276
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
CVE-2026-102278
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
CVE-2026-102266
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
CVE-2026-102265
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
PyJWT accepts public JWK containers as HMAC secrets
CVE-2026-102273
PyJWT accepts public JWK containers as HMAC secrets
PyJWT BOM Bypass
CVE-2026-102272
PyJWT BOM Bypass
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
CVE-2026-102271 · CVE-2022-29217
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / veri
roxmltree through 0.21.1 Denial of Service via Quadratic Parsing
CVE-2026-92987
roxmltree through 0.21.1 Denial of Service via Quadratic Parsing
Failed X509_verify_cert leaves unverified CA in shared CertManager
CVE-2026-89135
Failed X509_verify_cert leaves unverified CA in shared CertManager
OCSP stapling v2 multi accepts non-CA chain certificates as issuers
CVE-2026-89102
OCSP stapling v2 multi accepts non-CA chain certificates as issuers