Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment
CVE-2026-100699
Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser)
#advisory
共收录 23334 条相关情报。
← 返回所有主题Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex
CVE-2026-100698
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/f
Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver
CVE-2026-100697
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.
Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver
CVE-2026-100696
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the option
Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
CVE-2026-100695
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpol
Hugo before 0.166.0 Cross-Site Scripting via text/org
CVE-2026-100694
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media t
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass
CVE-2026-100693
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-litera
Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
CVE-2026-100692
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopp
Hugo before 0.166.0 Stored XSS via lineAnchors code block option
CVE-2026-100691
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does no
Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
CVE-2026-100690
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.j
GitPython before 3.1.62 Path Traversal via gitmodules path
CVE-2026-100689
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodu
Budibase server before 3.45.0 Cross-Tenant Information Disclosure
CVE-2026-100688
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/
Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
CVE-2026-100687
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table update
Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps
CVE-2026-100686
Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endp
Budibase before 3.45.0 Information Disclosure via Chat Links
CVE-2026-100685
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enume
Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
CVE-2026-100684
Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server.
Budibase before 3.45.0 SQL Injection via column-rename DDL
CVE-2026-100683
Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlT
Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink
CVE-2026-100682
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extrac
Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
CVE-2026-100681
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability
Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import
CVE-2026-100680
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validat