IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates...
CVE-2026-9744
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validati
#advisory
共收录 23717 条相关情报。
← 返回所有主题IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the...
CVE-2026-8862
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code,
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates...
CVE-2026-9036
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validati
SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
**CVE:** This vulnerability corresponds to [CVE-2026-68584](https://nvd.nist.gov/vuln/detail/CVE-2026-68584). ### Summa
SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered
CVE-2026-68585
**CVE:** This vulnerability corresponds to [CVE-2026-68585](https://nvd.nist.gov/vuln/detail/CVE-2026-68585). ### Summa
SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints ar...
CVE-2026-68586
**CVE:** This vulnerability corresponds to [CVE-2026-68586](https://nvd.nist.gov/vuln/detail/CVE-2026-68586). ### Summa
SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check
CVE-2026-68587
**CVE:** This vulnerability corresponds to [CVE-2026-68587](https://nvd.nist.gov/vuln/detail/CVE-2026-68587). ### Summa
SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on ...
CVE-2026-69083
**CVE:** This vulnerability corresponds to [CVE-2026-69083](https://nvd.nist.gov/vuln/detail/CVE-2026-69083). ### Summa
toml-node: Uncontrolled Recursion
CVE-2026-77465
### Summary `toml.parse()` crashes with an uncaught `RangeError: Maximum call stack size exceeded` when parsing deeply
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
CVE-2026-63376
### Summary `toml.parse()` writes attacker-controlled keys onto `Object.prototype`. The compiler protects the tables it
SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure
CVE-2026-69086
**CVE:** This vulnerability corresponds to [CVE-2026-69086](https://nvd.nist.gov/vuln/detail/CVE-2026-69086). ### Summa
Phoenix: Unbounded channel joins per transport enables DoS over few connections
CVE-2026-56811
### Summary Phoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundr
Phoenix: Presence keys colliding with `Object.prototype` members break existence checks
CVE-2026-56812
### Summary The Phoenix JavaScript presence client (`assets/js/phoenix/presence.js`) tests whether a presence already e
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
CVE-2026-71429
## Description The path filters `pick`, `ignore`, `filter`, and `replace` — the library's headline "surgical extraction
SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write
CVE-2026-69084
**CVE:** This vulnerability corresponds to [CVE-2026-69084](https://nvd.nist.gov/vuln/detail/CVE-2026-69084). ### Summa
amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
CVE-2026-79921
**Summary** A vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can for
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
CVE-2026-63670
### Summary A mutation-XSS / allowedTags bypass: when `textarea` (or `xmp`) is included in `allowedTags`, an input conta
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
CVE-2026-63669
## Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare `editRole` / `publishRole` (a
Material for MkDocs: DOM XSS in search suggestions via query parameter
CVE-2026-73295
### Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optio
TOON: Prototype pollution when decoding untrusted TOON input
CVE-2026-82404
### Summary Decoding attacker-controlled TOON containing a `__proto__`, `constructor`, or `prototype` key wrote through