Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
CVE-2026-107805
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication pat
#advisory
共收录 23210 条相关情报。
← 返回所有主题Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
CVE-2026-107804
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not pr
Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile
CVE-2026-95702
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacke
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaus
Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream
CVE-2026-108104
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that
Stack buffer overflow in illumos reparsed nfs-basic plugin allows local users to crash the daemon
CVE-2026-104115
A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. ge
NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon
CVE-2026-104114
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwa
Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory
CVE-2026-104112
A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel mem
Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones
CVE-2026-104116
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disr
Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership
CVE-2026-104117
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent
KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction
CVE-2026-104081
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/hel
Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host
CVE-2026-102916
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-p
Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request
CVE-2026-108105
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows r
Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE
CVE-2026-108103
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold()
Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE
CVE-2026-108102
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfc
HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter
CVE-2026-108100
HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL
ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter
CVE-2026-107803
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint
Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
CVE-2026-103413
Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled
Apache Camel Karavan: project file name path traversal when committing a project to Git
CVE-2026-103412
Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan.
Packet CTR reports a full success length after the counter is exhausted
CVE-2026-71884
In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested inp