Applications built on MongoDB Entity Framework Core Provider which combine independent encryption...
CVE-2026-92756
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this prov
#advisory
共收录 23421 条相关情报。
← 返回所有主题Grav CMS vulnerable to remote code execution via .zip file upload
CVE-2026-72819
### Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
CVE-2026-75837
## Summary The core Flex group blueprint `system/blueprints/user/group.yaml` (access field, lines 48-55) omits the `secu
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
CVE-2026-75834
## Vulnerability Details **Component**: getgrav/grav core **File**: `system/src/Grav/Common/Security.php` **Function**:
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
CVE-2026-75827
## Affected versions and vulnerable location - Confirmed on grav core at `78ebfc1` (tag 2.0.13). - Sinks: - `system/s
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
CVE-2026-75828
## Affected versions and vulnerable location - Confirmed on grav core at `78ebfc1` (tag 2.0.13). - Detector: `system/sr
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
CVE-2026-74907
**Verified against:** `getgrav/grav` devel branch, `GRAV_VERSION = "2.0.15"`, file `index.php ## Title Unauthenticated
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
CVE-2026-72695
# Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion ## Summary A path traversal vulnerab
CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP
CVE-2026-86003
### Summary CoreDNS accepted [RFC 2136](https://datatracker.ietf.org/doc/html/rfc2136) UPDATE messages over DoH, DoH3,
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
CVE-2026-86000
## Summary soupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared `IDENTIFI
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
CVE-2026-85999
## Summary Before tokenizing, `selector_iter` trims leading/trailing whitespace and comments by running two regexes ove
@platejs/core HTML deserialization can trigger browser behavior during parsing
CVE-2026-88976
### Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML a
react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU
CVE-2026-84997
### Summary A malformed HTTP message using `Transfer-Encoding: chunked` can drive `React\Http\Io\ChunkedDecoder` into a
CoreDNS: Unauthenticated memory exhaustion in custom transports
CVE-2026-82399
### Summary CoreDNS parses attacker-controlled DNS section counts before validating them on DNS-over-HTTPS (DoH and DoH
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
CVE-2026-81876
### Summary A malformed Smart Health Card (SHC) JWT with `zip: "DEF"` and an empty or truncated DEFLATE payload causes `
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
CVE-2026-81875
### Summary `SHCParser` inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit
djust: A template binding inherits a context safety grant it never earned (XSS)
A context safety grant was inherited by a template **binding** that never earned it, so rebinding a name the view had ma
djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
Five independent defects in djust's template auto-escaping cause attacker-controlled input to be rendered as live markup
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
CVE-2026-81871
### Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creat
OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
CVE-2026-81870
### Summary OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an inte