SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146
CVE-2026-87948
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO -
2026-10-23 归档
今日共收录 1236 条安全情报，包含 262 个 CVE，575 篇安全通告，以及 100 篇研究论文。
← 返回归档列表SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147
CVE-2026-87949
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO -
SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148
CVE-2026-87950
Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Da
SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149
CVE-2026-87951
Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded
SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150
CVE-2026-87952
Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with
SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151
CVE-2026-87953
Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forge
Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
CVE-2026-96369
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly
Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
CVE-2026-96375
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects
Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
CVE-2026-96376
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud
Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178
CVE-2026-96374
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
CVE-2026-114144
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
CVE-2026-114143
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
CVE-2026-114142
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled prope
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
CVE-2026-114141
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() func
nbconvert: File write via path traversal in cell output filenames
CVE-2026-114140
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4
leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal
CVE-2026-114377
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the functio
leomoon-studios wiki-go API editor.go SourceHandler path traversal
CVE-2026-114376
A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function Sa
leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
CVE-2026-114375
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler o
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
CVE-2026-114374
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file inte
Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP
CVE-2026-78118
The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it