pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
CVE-2026-53720
pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does
#advisory
共收录 23717 条相关情报。
← 返回所有主题Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
CVE-2026-50554
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauth
Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
CVE-2026-85237
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unre
Signum Node: Integer overflow in SMART_FEES fee distribution allows arbitrary miner reward inflation
CVE-2026-48486
Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algori
Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing
CVE-2026-75036
A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet co
MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
CVE-2026-85236
A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed
Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass
CVE-2026-75035
A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user,
Rancher: SAML Assertion Replay
CVE-2026-75034
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recor
Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing
CVE-2026-75033
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io
Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole
CVE-2026-71404
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settabl
MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
CVE-2026-85230
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widge
Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind
CVE-2026-71403
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `userna
Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
CVE-2026-85227
MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The t
MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations
CVE-2026-85226
MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from ma
MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks
CVE-2026-85221
MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property w
Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints
CVE-2026-85213
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueE
CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check
CVE-2026-85212
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns
Label Studio through 1.23.0 Cross-Organization Storage URI Resolution
CVE-2026-85211
Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endp
Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
CVE-2026-85210
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registere
Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
CVE-2026-85183
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to es