OWASP Coraza WAF: Cookie Parser Confusion
CVE-2026-107835
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.P
2026-10-10 归档
今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。
← 返回归档列表OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor
CVE-2026-107834
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multip
OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion
CVE-2026-107833
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessRes
OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
CVE-2026-107826
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON i
OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations
CVE-2026-107825
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
CVE-2026-108261
### Summary The TinaCMS admin builds its preview `` from the `/~/*` hash-router splat without checking that the value s
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
CVE-2026-107839
### Summary The AoE3 `POST /game/cloud/getFileURL` handler in `luskaner/ageLANServer`'s bundled game server decodes an a
pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
CVE-2026-107841
### Impact `pacioli-guard`'s document-layer consent gate requires a human-minted, single-use, document-bound and **act-
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
CVE-2026-107812
## Summary The self-upgrade downloads the release binary and its checksum (`*.tar.gz` and `*.tar.gz.digest`) through the
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
CVE-2026-107809
## Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named `token` and the `AuthRequired` middleware accept
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
CVE-2026-107811
Summary 0xJacky/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credent
Alert for CVE-2025-61882
CVE-2025-61882
Alert for CVE-2025-61882
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike Announces Continuous Identity for AI Agents
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
CVE-2015-3306
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Expl
pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
CVE-2026-107841
pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
CVE-2026-107813
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node a
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search
CVE-2026-108111
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that ex
AdonisJS: Unencoded route parameters can produce open redirects
CVE-2026-107718
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, Adonis