AWS EFS CSI Driver Mount Option Injection via mounttargetipmap
CVE-2026-103505
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-drive
2026-10-02 归档
今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist
CVE-2026-103687
A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the f
rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting
CVE-2026-103686
A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of t
Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation
CVE-2026-103680
A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numb
Tnef: use-after-free and double-free in get_body_files() via multi-value body extraction
CVE-2026-103679
A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport
Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value
CVE-2026-103678
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing un
Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
CVE-2026-88789
Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apa
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
CVE-2026-103292
Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emit
Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch
CVE-2026-103291
Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetchi
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
CVE-2026-103290
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service.
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
CVE-2026-103289
Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated memb
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
CVE-2026-103288
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions fro
Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
CVE-2026-103287
Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that all
Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications
CVE-2026-103286
Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that a
Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback
CVE-2026-103284
Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint
Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
CVE-2026-103283
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to lo
Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token
CVE-2026-103282
Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows
Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API
CVE-2026-103281
Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-priv
Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint
CVE-2026-103280
Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpo
Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe
CVE-2026-103278
Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers t