In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops...
CVE-2026-89696
In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to p
#advisory
共收录 23661 条相关情报。
← 返回所有主题In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds...
CVE-2026-89719
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state(
In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate...
CVE-2026-89716
In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate use
In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write()...
CVE-2026-89697
In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATT
Shopper: Missing authorization on product removal actions in CollectionProducts component
CVE-2026-56825
## Title Missing authorization on product removal actions in CollectionProducts component ## Description A lack of au
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
CVE-2026-56830
## Title Missing authorization on Media sub-form store action allows unpermissioned product media update ## Descriptio
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
CVE-2026-56829
## Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component ## Descript
Shopper: privilege escalation via improper Livewire admin component authorization
CVE-2026-56828
## Summary Three Livewire admin components in `shopper/framework` (latest master at commit `fcd0c59`, released as v2.8.
Shopping privilege escalation through missing authorization in Settings components
CVE-2026-56826
## Summary Four Livewire components in the Settings area expose destructive Filament actions (`delete` / `edit`) that p
Shopper: Negative discount values accepted and propagated through order calculation pipeline
CVE-2026-56831
## Summary The Shopper Framework discount management functionality accepts negative discount values without server-side
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
CVE-2026-56827
## Summary Five Filament `groupedBulkActions` blocks across the Shopper admin Livewire pages omit the `->authorize(...)
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
CVE-2026-11745
# Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD `ServerKeyVerifier` lambda that retu
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
CVE-2026-11746
## Vulnerability `ZooKeeperReplicationConfig.secret()` silently substitutes the hard-coded constant `"ch4n63m3"` (leets
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion
CVE-2026-11748
# Vulnerability `SearchFirstActiveDirectoryRealm.findUserDn()` substitutes the user-supplied username from the login fo
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
CVE-2026-59971
## Summary In SSE/HTTP transport mode, `mysql_mcp_server` constructs `SseServerTransport` without passing `security_set
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description
CVE-2026-81911
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_templ
GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw
CVE-2026-53952
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic f
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow...
CVE-2026-89151
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state...
CVE-2026-78135
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CH