Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A...
CVE-2026-95602
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploitin
#advisory
共收录 23334 条相关情报。
← 返回所有主题Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
CVE-2026-95604
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a...
CVE-2026-96546
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompre
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted...
CVE-2026-96545
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that ca
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
CVE-2026-77394
## Summary A user who can save a telemetry **screen** (permission `system_set`) can embed JavaScript in a screen `BUTTON
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
CVE-2026-82407
**Location:** `core/kapp/validators/validators.go:201` (`Register`), (`genesis/checking/nodesSetupChecker.go:73`). `core
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
CVE-2026-82409
**Component:** Elasticsearch indexer (`indexer/`) **Primary location:** `indexer/common.go:2395-2407` (`serializedDataFo
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace
CVE-2026-82406
**Location:** `core/kapp/market/market.go` — `Buy()` (approx. L281–436)\ **Severity:** High The native marketplace enfo
Formie: Missing authorization on sent notification resend modal exposes submission PII
CVE-2026-76089
### Impact The control panel action `formie/sent-notifications/get-resend-modal-content` (`SentNotificationsController:
Jawn: Quadratic parsing effort in AsyncParser
CVE-2026-61814
`AsyncParser` can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across
Jawn: Uncontrolled nesting depth in JSON parser
CVE-2026-59990
The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input. ### Impact A remote atta
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller
CVE-2026-82405
### Description The VM built-in function `KleverUpdateAccountPermission` (registered always-active, `creator.go:381-390
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller
CVE-2026-82405
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
CVE-2026-82409
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataF
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
CVE-2026-82407
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.g
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
CVE-2026-86065
## Summary The unauthenticated WebSocket endpoint `GET /subscribe` is registered `open: true` by default (`config/node/a
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
CVE-2026-86065
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe e
Klever-Go: /log controls global node logging
CVE-2026-86064
An unauthenticated client can connect to `GET /log`, send an arbitrary logger profile as the first WebSocket message, an
Klever-Go: /log controls global node logging
CVE-2026-86064
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSock
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace
CVE-2026-82406
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function c