OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

CVE-2026-118669

## Summary OAuthlib's token grant handlers can authenticate one client while authorizing the grant type and requested s

来源摘录 · GitHub Advisory

OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

CVE-2026-116677

## Summary The authenticated REST API endpoint for downloading a CA Certificate Revocation List resolves the requested

来源摘录 · GitHub Advisory

signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher

### Summary The app store icon code (`dist/appstore/icon-probe.js` around line 200 and `icon-bytes.js` around line 138)

来源摘录 · GitHub Advisory

Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

### Summary Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged

来源摘录 · GitHub Advisory

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution

## Summary The ICO loader allocates `data_size + BMP_FILE_HEADER_LEN` bytes after reading a 32-bit attacker-controlled

来源摘录 · GitHub Advisory

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash

### Summary Out-of-bounds heap write in imgproxy's ICO loader (`vips/icoload.c`): when the ICO entry's image data buffe

来源摘录 · GitHub Advisory

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field

### Summary Unbounded and unvalidated memory allocation in imgproxy's ICO loader (`vips/icoload.c`). An attacker-contro

来源摘录 · GitHub Advisory

anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

## Summary anacrolix/torrent's bencode decoder (`bencode/`) applies **no limit on the nesting depth** of nested diction

来源摘录 · GitHub Advisory

AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

CVE-2026-96634

### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used t

来源摘录 · GitHub Advisory

AdminNeo SQLite Database-List Drop Arbitrary File Deletion

CVE-2026-96633

## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process thro

来源摘录 · GitHub Advisory

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

CVE-2026-96631

### Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forw

来源摘录 · GitHub Advisory

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

CVE-2026-96632

## Summary AdminNeo inserts the database server's version string into a `` tag that carries a valid CSP nonce, without

来源摘录 · GitHub Advisory

AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)

CVE-2026-96630

## Summary Adminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not

来源摘录 · GitHub Advisory

AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery

CVE-2026-96629

### Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits bot

来源摘录 · GitHub Advisory

NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

CVE-2026-54442

### Summary The URL validation regex `^(https?:/)?/.*` added to emissary's `NavAction.java` allows protocol-relative UR

来源摘录 · GitHub Advisory

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in...

CVE-2026-16760

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_

来源摘录 · NVD / GitHub Advisory

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class throug...

CVE-2026-118938

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Val

来源摘录 · NVD / GitHub Advisory

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billi...

CVE-2026-111578

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape sev

来源摘录 · NVD / GitHub Advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute nam...

CVE-2026-117645

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework p

来源摘录 · NVD / GitHub Advisory

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the le...

CVE-2026-78403

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Ove

来源摘录 · NVD / GitHub Advisory