Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)
CVE-2026-71537
Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Se
#advisory
共收录 23421 条相关情报。
← 返回所有主题Moquette: Missing Authorization in io.moquette:moquette-broker
CVE-2026-85058
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last W
Perses's unvalidated project parameter enables filesystem path traversal
CVE-2026-63445
### Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the re
Perses's missing authorization in datasource proxy allows cross-scope secret disclosure
CVE-2026-63199
### Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret na
Perses's project query parameter authorization bypass exposes cross-project resources
CVE-2026-63458
### Impact _What kind of vulnerability is it?_ An authenticated user who is only a viewer on project team-a requests GE
Perses: Unvalidated project parameter enables filesystem path traversal
CVE-2026-63445
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoint
Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure
CVE-2026-63199
Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the
Perses project query parameter authorization bypass exposes cross-project resources
CVE-2026-63458
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenti
Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware
CVE-2026-32641
Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/ht
c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
CVE-2026-69184
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression poi
c-ares: Memory-amplification denial of service via unvalidated DNS header record counts
CVE-2026-69186
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NS
Icinga 2 DSL Injection via Unescaped Import Template Name
CVE-2026-61552
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes atta
Icinga 2: Stack overflow via deeply nested JSON objects
CVE-2026-61551
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaus
Icinga 2: Improper access control for JSON-RPC update certificate messages
CVE-2026-61550
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC mes
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
CVE-2026-91127
### Summary Before 2.3.1, the legacy `.doc` renderer emitted document hyperlink targets after HTML escaping but without
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
CVE-2026-91127
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applic
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
CVE-2026-77301
### Summary adm-zip allocates an entry's output buffer from the declared uncompressed size (central-directory `size` fie
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
CVE-2026-77339
## Summary A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener wh
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
CVE-2026-81505
## Summary frain-dev/convoy (all versions up to and including v26.6.2, no patch available) lets any authenticated caller
md-editor-v3: XSS via fenced-code language rendering bypass
CVE-2026-84992
### Summary `MdPreview` interpolates a fenced-code language into HTML attributes without escaping it. A crafted info str