Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle ...
CVE-2026-96375
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects
2026-10-22 归档
今日共收录 1761 条安全情报，包含 937 个 CVE，415 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows...
CVE-2026-96369
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly
Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider ...
CVE-2026-87951
Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded
Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows...
CVE-2026-87950
Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Da
Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows...
CVE-2026-87953
Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forge
Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider ...
CVE-2026-87952
Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...
CVE-2026-87949
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO -
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...
CVE-2026-87948
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO -
Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute...
CVE-2026-87946
Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affect
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service...
CVE-2026-87945
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the
Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service...
CVE-2026-87947
Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature S
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows...
CVE-2026-87944
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiT
Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful...
CVE-2026-87943
Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows...
CVE-2026-87940
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
CVE-2026-112406
``` ============================================================================ Infinite loop in PdfParser.rewrite_page
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
CVE-2026-112901
``` ============================================================================ ReDoS in XbmImagePlugin: 512-byte file
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
CVE-2026-112401
``` ============================================================================ Quadratic GIF comment concatenation all
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
CVE-2026-112948
### Summary In Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the s
Vitest: Code injection via unauthenticated manual mock registration
CVE-2026-112949
### Summary `@vitest/mocker`'s `interceptorPlugin` accepts mock registrations on Vite's dev-server WebSocket with no au
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
CVE-2026-112950
## Summary The path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advi