Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login
CVE-2026-107828
Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Wei
#advisory
共收录 23210 条相关情报。
← 返回所有主题Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type
CVE-2026-107801
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute
Jivejdon through 5.0 Stored XSS via Private Short Messages
CVE-2026-107800
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject
Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering
CVE-2026-107799
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject
Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter
CVE-2026-107798
jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the defaul
Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters
CVE-2026-107797
Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that
Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters
CVE-2026-107796
Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in applica
Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete
CVE-2026-107793
Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that al
Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move
CVE-2026-107792
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToFo
Jivejdon through 5.0 SQL Injection via username in userListAction
CVE-2025-71428
Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenti
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
CVE-2026-107721
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
CVE-2026-107720
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned
fast-jwt: Verifier cache accepts expired JWTs without iat.
CVE-2026-107719
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can contin
AdonisJS: Unencoded route parameters can produce open redirects
CVE-2026-107718
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, Adonis
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0...
CVE-2026-78388
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cro
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
CVE-2026-107716
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry d
Mechanize sends credential headers to another host after an HTTP redirect
CVE-2026-107715
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied
Mechanize sends credential headers to a different scheme or port after a redirect
CVE-2026-107714
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response
Mechanize sends credential headers to another origin after a meta refresh
CVE-2026-107399
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin tru
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
CVE-2026-107391
### Summary `StsdAtom.get()` in `lib/mp4/AtomToken.ts` parses an MP4 `stsd` (sample description) box's entry table by a