MariaDB: mysql_json plugin OOB reads
CVE-2026-107817
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3
#advisory
共收录 23210 条相关情报。
← 返回所有主题MariaDB: `qc_info` plugin can do OOB reads if query contains \0
CVE-2026-107816
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
## Summary `Api.getUserData` (legacy) and `Api.get_userdata` are declared with `@permission(Perms.ANY)` and are reachab
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
## Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carryin
pyLoad: Api.set_user_permission never invalidates the target's session
### Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented `/api/` RP
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
## Summary pyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken di
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
### Summary `UnTar._safe_extractall` — the hardening added for GHSA-mvwx-582f-56r7 — validates member **names** and sym
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
CVE-2026-107812
## Summary The self-upgrade downloads the release binary and its checksum (`*.tar.gz` and `*.tar.gz.digest`) through the
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
CVE-2026-107808
## Summary nginx-ui supports two second-factor methods — TOTP (OTP) and WebAuthn passkeys — and reports an account as 2
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
CVE-2026-107809
## Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named `token` and the `AuthRequired` middleware accept
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
CVE-2026-107813
## Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session (OTP step-up) requirement added to the nginx, cert
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
CVE-2026-107811
Summary 0xJacky/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credent
Nginx UI: Node Secret Credential Exposure via URL Query Parameter
CVE-2026-107807
## 1. Vulnerability Summary nginx-ui's `Node.Secret` is a master credential that bypasses all JWT/password authenticati
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
CVE-2026-107810
### Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the r
pyLoad has an authentication bypass in API key validation (check_apikey cache)
## Summary The API-key cache in `check_apikey()` allows an attacker to authenticate with a **forged API key** as long a
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
CVE-2026-55797
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
CVE-2026-75597
### Summary The `/web/` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without an
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
CVE-2026-55797
### Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a p
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
CVE-2026-48484
## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole