Go JOSE: DoS when parsing JWKs that contain RSA keys
CVE-2026-116587
### Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. ### Details go
#advisory
共收录 23093 条相关情报。
← 返回所有主题CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
CVE-2026-116683
### Impact CTFer.io's CTFd Terraform Provider stores `ctfd_team.password` as non-sensitive values (CWE-522). A local or
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
CVE-2026-116683
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an ...
CVE-2026-57188
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2
MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement
CVE-2026-118173
MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for requ
CVE-2026-118171
CVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. T
CVE-2026-118172
CVE-2026-118172
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect
CVE-2026-118170
CVE-2026-118170
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made w
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57202
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2
Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57188
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2
FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
CVE-2026-116682
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read hand
reduxjs redux-devtools Remotedev Server evalAction code injection
CVE-2026-117526
A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of
Homebox generic notifier SSRF via HTTP redirect after URL validation
CVE-2026-116680
HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs wi
X.Org Server XKB SetGeometry TextDoodad Double Free
CVE-2026-88812
A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached
CVE-2026-118132
CVE-2026-118132
NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsa
Neko: Authorization bypass in legacy WebRTC input handling
CVE-2026-116679
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deploy
oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection
CVE-2026-117516
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the
Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs
CVE-2026-116678
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader v
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
CVE-2026-116677
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI manage
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a s...
CVE-2026-57201
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2