(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange
CVE-2026-93304
A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has
#advisory
共收录 23334 条相关情报。
← 返回所有主题CRL check skipped when OCSP enabled and certificate has no OCSP URL
CVE-2026-94417
When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL ski
Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY
CVE-2026-94418
Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse t
Client session cache reference poisoning allows resumption with wrong server
CVE-2026-94419
Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of th
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer
CVE-2026-100741
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value...
CVE-2026-96899
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one o
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube...
CVE-2026-96895
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before output
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform...
CVE-2026-97227
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership chec
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on...
CVE-2026-96897
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and...
CVE-2026-97319
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribu
The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not...
CVE-2026-96896
The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation c
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not...
CVE-2026-86839
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not...
CVE-2026-86841
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of u
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or...
CVE-2026-92436
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loa
【安全通告】Linux Kernel vhost "Vghost" 本地权限提升漏洞风险通告（CVE-2026-74580）
CVE-2026-74580
【安全通告】Linux Kernel vhost "Vghost" 本地权限提升漏洞风险通告（CVE-2026-74580）
Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both...
CVE-2026-100863
Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/serv
heym before 0.0.105 fails to apply egress guards to integration services that use credential...
CVE-2026-100861
heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowin
heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord,...
CVE-2026-100858
heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nod
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext...
CVE-2026-100862
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0
heym before 0.0.105 does not act on the result of the credential authorization lookup in the...
CVE-2026-100860
heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backen