Steeltoe: Header-forwarded client cert lacks proof of private-key possession
CVE-2026-81868
### Summary When Steeltoe's certificate-based authorization (`UseCertificateAuthorization`) is configured, the default
#advisory
共收录 23421 条相关情报。
← 返回所有主题Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)
CVE-2026-81516
## Summary Steeltoe's Consul discovery client parses the `secure` metadata field on each registered service instance us
Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)
CVE-2026-81515
## Summary Steeltoe's Eureka discovery client deserializes the registry response as a single unit. If any registered in
Jupyter Server: 5xx request logging leaks token-bearing Referer header values
CVE-2026-86049
### Summary When a request returns a 500, `jupyter_server/log.py` logs a small JSON block of request headers. The Ref
Svelte devalue: DoS via malformed input
CVE-2026-81176
### Impact `devalue.parse` prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CVE-2026-79752
### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd(
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
CVE-2026-72697
## Summary The `media_directory()` Twig function is allow-listed for use in sandboxed, editor-authored page content (`s
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
CVE-2026-76839
## Summary `system/config/security.yaml`'s Twig sandbox policy allow-lists `offsetget` and `offsetexists` for `Grav\Com
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
CVE-2026-76846
## Summary `system/config/security.yaml`'s default `twig_sandbox.config_denied_paths` list (`plugins`, `streams`, `secu
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
CVE-2026-72698
## Summary `Grav\Common\Twig\Twig::init()` unconditionally puts the raw `system`, `site`, and `theme` config arrays int
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
CVE-2026-72701
## Summary `Grav\Common\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, comp
NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection
CVE-2026-93337
NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection crea
Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection
CVE-2026-92993
A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of
Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
CVE-2026-92943
Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for
TS3 Manager: Reflected XSS via /api/download port parameter steals operator session
CVE-2026-54253
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in pac
MCP Documentation Server: Web UI API binds to all interfaces without authentication by default
CVE-2026-54504
MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13
GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler
CVE-2026-54617
GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
CVE-2026-54524
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the
Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle
CVE-2026-52852
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups a
Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions
CVE-2026-52851
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an ob