PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
CVE-2026-104844
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, s
#advisory
共收录 23210 条相关情报。
← 返回所有主题uv: Path traversal on Windows through wheel extraction
CVE-2026-104843
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows ca
Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
CVE-2026-90970
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 1
xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape
CVE-2026-94422
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass th
User Impersonation/Authorization Bypass in XMPP Server ejabberd
CVE-2026-104733
User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via un
YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
CVE-2026-104473
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inj
YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
CVE-2026-104472
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unaut
YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import
CVE-2026-104471
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote
YesWiki before 4.6.7 SSRF and XSS via Bazar valeur Action
CVE-2026-104470
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page ed
YesWiki before 4.6.7 Session Fixation via Login in AuthController.php
CVE-2026-104469
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions be
YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction
CVE-2026-104468
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old passwo
YesWiki before 4.6.7 Authorization Bypass via Public API Mode
CVE-2026-104467
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenti
YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute
CVE-2026-104466
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who
YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler
CVE-2026-104465
YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to in
YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter
CVE-2026-104464
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make
YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox
CVE-2026-104463
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigg
YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter
CVE-2026-104462
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unesca
YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField
CVE-2026-104461
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only t
YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch
CVE-2026-104460
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list opt
YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle
CVE-2026-104459
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticate