In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In...
CVE-2026-92580
In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClie
#advisory
共收录 23421 条相关情报。
← 返回所有主题A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the...
CVE-2026-85469
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docke
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to...
CVE-2026-92583
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt...
CVE-2026-92579
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without
OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that...
CVE-2026-61709
### Description In OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded. ### Prec
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
CVE-2026-58657
## Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media act
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
CVE-2026-63671
## Summary `@nuxtjs/mdc` renders untrusted markdown (including raw HTML) to a Vue component tree. Across two prior advi
RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
CVE-2026-63128
### Summary An unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table o
RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
CVE-2026-63127
### Summary The `rmcp` library does not validate the `resource` parameter in OAuth Protected Resource metadata (RFC 9728
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
CVE-2026-61453
## Summary The XSS blueprint validator (`Security::detectXss()`) runs on the **raw page content before Twig processing*
vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions
CVE-2026-57173
### Summary The audio decode-duration guard (`max_duration_s`, env `VLLM_MAX_AUDIO_DECODE_DURATION_S`, default 600s) tha
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
CVE-2026-59193
### Summary An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archi
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
CVE-2026-61599
### Impact The djust live transport resolves the LiveView to mount from a **client-supplied dotted path** by calling `__
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
CVE-2026-61589
### Impact The WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFactory().
djust has broken object-level access control (IDOR)
CVE-2026-61596
### Impact djust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) was enforced on the WebSoc
djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
CVE-2026-61588
### Impact When a Django `Model` instance is assigned to a **public** view attribute, djust serialized it to the client
djust has an authorization bypass on the WebSocket/SSE mount path
CVE-2026-61594
### Impact The live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain
djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)
CVE-2026-61591
### Impact For views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored o
djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)
CVE-2026-61592
### Impact SSE sessions were keyed solely by a **client-chosen** `session_id` with no binding to the authenticated user
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
CVE-2026-61597
### Impact Many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-suppl