Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
CVE-2026-104417
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows au
#advisory
共收录 23210 条相关情报。
← 返回所有主题Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API
CVE-2026-104416
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff user
Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
CVE-2026-104415
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level
Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses
CVE-2026-104414
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untr
Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images
CVE-2026-104413
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including
Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment
CVE-2026-104412
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Edi
Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads
CVE-2026-104411
Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scr
SiYuan before 3.8.5 Information Disclosure via /api/export/preview
CVE-2026-104410
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protec
SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo
CVE-2026-103763
SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn met
SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints
CVE-2026-103762
SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, a
Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address
CVE-2026-97876
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot a
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
CVE-2026-97652
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflecte
Argument Injection leading to arbitrary process termination in gotop
CVE-2026-91784
cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passe
NTRU leaks private key information by reducing secret values with a non-constant-time integer division
CVE-2026-18036
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference i
Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content
CVE-2026-97641
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content i
Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points
CVE-2026-17508
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost paramete
MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender
CVE-2026-17507
In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index
Quadratic-time escaping when converting X.509 distinguished names to strings
CVE-2026-103604
Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.Va
Unbounded HSS public key level count allows huge array allocation during signature verification
CVE-2026-103603
Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legi
Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts
CVE-2026-103602
Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.