Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction...
CVE-2026-111284
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authentic
#advisory
共收录 22969 条相关情报。
← 返回所有主题LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote()...
CVE-2026-111272
LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar...
CVE-2026-111273
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable th
Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to...
CVE-2026-110918
Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to...
CVE-2026-110917
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote...
CVE-2026-110916
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially ex
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker...
CVE-2026-110915
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary cod
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
CVE-2026-102989
## Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someon
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
CVE-2026-102682
Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Dail
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
CVE-2026-94603
### Impact Podman v4.4.0 added a feature where container checkpoints (from the `podman container checkpoint` command) co
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
CVE-2026-102832
## Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the
SFTPGo source-side file-pattern filter bypass during copy operations
CVE-2026-103028
### Summary File pattern filters (`denied_patterns` / `allowed_patterns`) were evaluated on the destination of a copy o
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
CVE-2026-86063
The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using `git check
containerd: Unpack DoS via repeated opaque whiteouts
CVE-2026-95838
### Impact A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers cau
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
CVE-2026-85747
### Summary `registry/client.(*manifests).Get(ctx, dgst, …)` fetches a manifest by digest but never hashes the returned
Qwik: Crashing any Qwik Server via Resource thenable
CVE-2026-84994
### Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwi
containerd CRI plugin: Checkpoint restore bypasses destination security context
CVE-2026-95837
### Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint
Backstage: Improper access control in backend action invocation
CVE-2026-106495
### Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Exist
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
CVE-2026-100353
## Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array sc
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
CVE-2026-100354
## Summary kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader