Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to...
CVE-2026-110917
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted
2026-10-16 归档
今日共收录 833 条安全情报，包含 0 个 CVE，434 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote...
CVE-2026-110916
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially ex
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker...
CVE-2026-110915
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary cod
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
CVE-2026-102682
Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Dail
SFTPGo source-side file-pattern filter bypass during copy operations
CVE-2026-103028
### Summary File pattern filters (`denied_patterns` / `allowed_patterns`) were evaluated on the destination of a copy o
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
CVE-2026-86063
The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using `git check
containerd: Unpack DoS via repeated opaque whiteouts
CVE-2026-95838
### Impact A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers cau
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
CVE-2026-85747
### Summary `registry/client.(*manifests).Get(ctx, dgst, …)` fetches a manifest by digest but never hashes the returned
Qwik: Crashing any Qwik Server via Resource thenable
CVE-2026-84994
### Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwi
containerd CRI plugin: Checkpoint restore bypasses destination security context
CVE-2026-95837
### Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint
Backstage: Improper access control in backend action invocation
CVE-2026-106495
### Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Exist
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
CVE-2026-100353
## Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array sc
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
CVE-2026-100354
## Summary kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
CVE-2026-100352
## Summary kin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning
Talos Linux: Support bundle does not redact registry credentials
CVE-2026-77564
### Summary When generating a support bundle with `talosctl support` the credentials entered for private registries are
Appium: Symlink based Zip Slip in @appium/support ZIP extraction
CVE-2026-103975
### Summary CVE-2026-30973 [(GHSA-rfx7-4xw3-gh4m)](https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
CVE-2026-103030
### Summary `dio_http2_adapter` follows HTTP `Location` redirects without stripping sensitive request headers when the
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
CVE-2026-102748
### Summary Dgraph `v25.3.8` exposes a Zero HTTP administrative surface that is unauthenticated when port `6080` is rea
tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
CVE-2026-104266
### Impact An M4A file containing a sub-atom with a size of zero in the `----` atom makes the parser enter an infinite l
copyparty FTP: upload outside defined volumes (limited path traversal)
CVE-2026-104102
The FTP and FTPS server -- if enabled -- would allow uploading to any folder that the copyparty process had permission t