Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit ...

CVE-2026-112782

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymo

历史摘要 · 未重新核验 · NVD

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page fro...

CVE-2026-112781

Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected

历史摘要 · 未重新核验 · NVD

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class reso...

CVE-2026-112777

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its

历史摘要 · 未重新核验 · NVD

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string fie...

CVE-2026-112774

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrato

历史摘要 · 未重新核验 · NVD

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType...

CVE-2026-112772

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Pane

历史摘要 · 未重新核验 · NVD

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters r...

CVE-2026-112771

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, conta

历史摘要 · 未重新核验 · NVD

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An auth...

CVE-2026-112769

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissi

历史摘要 · 未重新核验 · NVD

A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshel...

CVE-2026-112252

A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Informat

历史摘要 · 未重新核验 · NVD

IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to ...

CVE-2026-3303

IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privi

历史摘要 · 未重新核验 · NVD

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a gen...

CVE-2026-112377

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connecti

历史摘要 · 未重新核验 · NVD

A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the fi...

CVE-2026-112247

A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information Sys

历史摘要 · 未重新核验 · NVD

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path diffe...

CVE-2026-111757

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveSt

历史摘要 · 未重新核验 · NVD

Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can su...

CVE-2026-105810

Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path.

历史摘要 · 未重新核验 · NVD

A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a ...

CVE-2025-60480

A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-D

历史摘要 · 未重新核验 · NVD

A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS)...

CVE-2025-55667

A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-

历史摘要 · 未重新核验 · NVD

A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a craf...

CVE-2025-55654

A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attacker

历史摘要 · 未重新核验 · NVD

A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via proc...

CVE-2025-52290

A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 all

历史摘要 · 未重新核验 · NVD

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t...

CVE-2023-38375

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embe

历史摘要 · 未重新核验 · NVD

Proof-Carrying Contracts: Commitments AI Agents Cannot Break

AI agents increasingly act on behalf of people or other agents, purchasing services, exchanging information and delegati

历史摘要 · 未重新核验 · arXiv cs.CR

SPECTER: Covert Data Exfiltration from Air-Gapped Systems via USB Power Modulation

We present SPECTER, a post-compromise covert channel that uses host-side USB power control to exfiltrate information fro

历史摘要 · 未重新核验 · arXiv cs.CR