A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to...
CVE-2026-105471
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87b
2026-10-06 归档
今日共收录 1258 条安全情报，包含 460 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an...
CVE-2026-91107
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record thr
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to...
CVE-2026-105469
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c9
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to...
CVE-2026-105470
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c9
In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup...
CVE-2026-103546
In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who
Docling simplifies document processing by parsing diverse formats and providing integrations with...
CVE-2026-105747
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to...
CVE-2026-105468
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d
In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled...
CVE-2026-0482
In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modificati
Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+...
CVE-2026-0461
Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices co
Werkzeug safe_join() allows Windows special device names
CVE-2026-102598
Werkzeug's `safe_join` function allows Windows device names as filenames when they have an empty ADS marker on NTFS. Th
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
CVE-2026-102829
# Security control bypass in `@simple-git/argv-parser`: Git's `VISUAL` editor fallback is not classified as `allowUnsafe
simple-git allows command execution through unblocked Git configuration includes
CVE-2026-102826
## Summary An OS command injection vulnerability in `git.clone()` allows any application that flows attacker-influenced
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
CVE-2026-102827
simple-git's blockUnsafeOperationsPlugin blocks dangerous git options (--upload-pack/--receive-pack/--exec/...) unless t
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
CVE-2026-96749
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
CVE-2026-96748
### Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
CVE-2026-96747
### Summary PyMongo passed the KMS endpoint of a data key verbatim into `parse_host()`, which returns any string ending
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
CVE-2026-102600
### Impact This is a **prototype pollution / improper client lookup** vulnerability in `@socket.io/cluster-engine`. Se
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
CVE-2026-104181
App-based multi-factor authentication management actions did not consistently require the user to confirm their current
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
CVE-2026-105758
### Summary An unauthenticated remote attacker can exhaust the memory of the vLLM API-server process by raising the req
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
CVE-2026-105760
## Summary The OpenAI-compatible chat endpoint accepts request-level video loader options through `media_io_kwargs`. A