TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
CVE-2026-102989
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.1
2026-10-14 归档
今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
CVE-2026-109955
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated at
Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
CVE-2026-109954
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requ
Stable Channel Update for Desktop
CVE-2026-110149 · CVE-2026-110166 · CVE-2026-110145 · CVE-2026-110168 · CVE-2026-110153 · CVE-2026-110148 · CVE-2026-110137 · CVE-2026-110152 · CVE-2026-110139 · CVE-2026-110162 · CVE-2026-110141 · CVE-2026-110163 · CVE-2026-110150 · CVE-2026-110147 · CVE-2026-110140 · CVE-2026-110144 · CVE-2026-110143 · CVE-2026-110160 · CVE-2026-110138 · CVE-2026-110161 · CVE-2026-110151 · CVE-2026-110157 · CVE-2026-110136 · CVE-2026-110165 · CVE-2026-110170 · CVE-2026-110159 · CVE-2026-110169 · CVE-2026-110158 · CVE-2026-110172 · CVE-2026-110164 · CVE-2026-110146 · CVE-2026-110156
The Stable channel has been updated to 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 to Linux which will roll
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
CVE-2026-104935
CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with ele
waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints
CVE-2026-110127
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that
waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints
CVE-2026-110126
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows
waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints
CVE-2026-110125
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members
Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints
CVE-2026-110123
Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to
MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
CVE-2026-110108
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage obje
RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
CVE-2026-110107
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated user
Squid Request Smuggling in HTTP Transfer-Encoding
CVE-2026-61642
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow
unstructured: Stored XSS via unescaped HTML generation
CVE-2026-104250
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, suc
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
CVE-2026-85990
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation an
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
CVE-2026-101899
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy trea
OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
CVE-2026-49264
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's Rev
Plane: XSS in work item comments
CVE-2026-102982
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes
DragonflyDB stream RDB deserialization double-free
CVE-2026-104192
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStrea
Gotify: Insufficiently Protected Password Change endpoint
CVE-2026-102603
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the pass
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or com...
CVE-2026-106173
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5