radare2: Uncontrolled resource consumption in radare2 PEF loader
CVE-2026-81880
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred
#advisory
共收录 23334 条相关情报。
← 返回所有主题MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
CVE-2026-95806
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar
radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling
CVE-2026-81879
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM han
radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser
CVE-2026-81878
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecod
radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser
CVE-2026-81881
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift fi
MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction
CVE-2026-95805
A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action t
MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
CVE-2026-95754
In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentica
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
CVE-2026-89407
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expres
MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name
CVE-2026-95703
In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem pro
MISP Path Traversal via Organization Name in Org-Statistics Logo Check
CVE-2026-95701
In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path co
MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
CVE-2026-95698
The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organizatio
MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata
CVE-2026-95697
MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to t
MISP Information Disclosure via Forged Upload Path
CVE-2026-95693
In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(),
MISP Missing Authorization on replaceSuggestionInReport Event Report Action
CVE-2026-95685
MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allo
CVE-2026-93088
CVE-2026-93088
SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregat
MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
CVE-2026-95683
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrich
MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View
CVE-2026-95682
MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org orga
MISP Unauthenticated Blind SSRF via XML Body Processing
CVE-2026-95679
MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build
MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation
CVE-2026-95674
In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list
MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add
CVE-2026-95671
In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element cap