SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata
CVE-2026-107736
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-
2026-10-10 归档
今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。
← 返回归档列表SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)
CVE-2026-107735
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestric
SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors
CVE-2026-107734
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is
SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service
CVE-2026-107731
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants
SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read
CVE-2026-107730
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacke
SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read
CVE-2026-107729
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
CVE-2026-107728
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on
Strawberry legacy graphql-ws retains naturally completed subscription slots
CVE-2026-107727
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscriptio
Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-107726
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.1
Hazelcast: Authorization bypass in IMap Predicates API
CVE-2026-107725
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.1
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
CVE-2026-107724
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or
Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions
CVE-2026-107831
Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-c
Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql
CVE-2026-107829
Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digest
Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login
CVE-2026-107828
Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Wei
Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type
CVE-2026-107801
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute
Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter
CVE-2026-107798
jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the defaul
Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters
CVE-2026-107797
Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that
Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete
CVE-2026-107793
Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that al
Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move
CVE-2026-107792
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToFo
Jivejdon through 5.0 SQL Injection via username in userListAction
CVE-2025-71428
Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenti