Ghost: Stored XSS via Embed Card Previews
CVE-2026-105643
### Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, inc
2026-10-08 归档
今日共收录 832 条安全情报，包含 0 个 CVE，435 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Ghost : Stored XSS via SVG Files in Content Imports
CVE-2026-105644
### Impact SVG images included in content imports were stored without sanitization. An attacker who convinced an Admini
Ghost: Regular Expression Denial of Service in External Media Inliner
CVE-2026-105645
### Impact A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unr
Ghost: Regular Expression Denial of Service in Content Import
CVE-2026-105646
### Impact A crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploit
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
CVE-2026-106121
## Summary `com.rabbitmq.tools.json.JSONReader.read()` never returns when its input ends inside a quoted string or a `/
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
CVE-2026-105744
### Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (`LatexBackendOptions
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
CVE-2026-105748
### Summary docling accepts serialized `DoclingDocument` JSON as an input format (`InputFormat.JSON_DOCLING`, enabled b
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
CVE-2026-105749
### Summary The HTML, JATS, ODS (OpenDocument spreadsheet) and BoxNote backends accept table `rowspan` / `colspan` valu
Docling imports plugin entry points before the allow_external_plugins check
CVE-2026-105745
### Summary `allow_external_plugins=False` (the default, and the CLI default) is meant to restrict docling to its own m
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
CVE-2026-106451
### Summary When no system-installed `liblz4-java` is found, `net.jpountz.util.Native.load()` extracts the bundled nati
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
CVE-2026-106449
### Summary When `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs
CVE-2026-106450
### Summary `LZ4FrameInputStream` allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every
Ghost: Server-Side Request Forgery in Bookmark Fetching
CVE-2026-105647
### Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
CVE-2026-105648
### Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
CVE-2026-105649
### Impact SVG media thumbnails, and SVG images uploaded with a non-SVG file extension, were stored without sanitizatio
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
CVE-2026-105699
### Summary Langflow's project-scoped MCP transport authenticates the caller for the `project_id` in the connection URL,
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
CVE-2026-94544
Pending `use cache` fills are shared across requests for the same key without distinguishing Draft Mode requests from re
Next.js has information disclosure in development server's Model Context Protocol endpoint
CVE-2026-94486
The Next.js development server (`next dev`) exposes a Model Context Protocol endpoint that does not verify which website
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
CVE-2026-94484
Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regen
Next.js has Server-Side Request Forgery in Image Optimization
CVE-2026-94483
## Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs)