Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
CVE-2026-104002
A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actor
2026-10-03 归档
今日共收录 1361 条安全情报，包含 499 个 CVE，489 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Uncontrolled recursion in the Ion reader in Amazon Ion Python
CVE-2026-104020
Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor t
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
CVE-2026-96780
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text(
stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
CVE-2026-104183
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
CVE-2026-104182
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
CVE-2026-104181
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3
Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive
CVE-2026-102514
Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea co
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
CVE-2026-53964
Document Merge Service is a document template merge service providing an API to manage templates and merge them with giv
OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect
CVE-2026-55252
OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes
NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files
CVE-2026-55251
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to
pgvector buffer overflow in IVFFlat index build
CVE-2026-103484
IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbit
Lektor 3.3.14 CSRF via Admin API Endpoints
CVE-2026-104059
Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows un
DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
CVE-2026-55083
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versi
Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique passw...
CVE-2026-94592
Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser accoun
The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the ...
CVE-2026-104055
The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitor
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
CVE-2026-96940
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically gene...
CVE-2026-94543
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapsho...
CVE-2026-51916
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in super
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound clean...
CVE-2026-104420
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scorin
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmw...
CVE-2026-86326
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does no