A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an...
CVE-2026-63020
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error mes
#advisory
共收录 23717 条相关情报。
← 返回所有主题When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability...
CVE-2026-77180
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configura
BIG-IP has a vulnerability where an authenticated user of any role may be able to create...
CVE-2026-66842
BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts th
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch(...
CVE-2026-78222
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX wo
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled ...
CVE-2026-14199
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than z
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation...
CVE-2026-12704
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo fi
tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication
CVE-2026-84840
A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file Intercepti
tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication
CVE-2026-84839
A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionalit
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
CVE-2026-84382
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_d
HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
CVE-2026-84381
HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpc
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
CVE-2026-84380
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
CVE-2026-84379
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_mu
PREVAIL: ALU32 pointer arithmetic accepted without is64 gate — verifier emits false PASS for pointer-corrupting programs
CVE-2026-53706
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the prevai
PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification
CVE-2026-53670
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Pre
PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification
CVE-2026-53671
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstra
HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
CVE-2026-84378
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src
libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
CVE-2026-82522
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers
Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2
CVE-2026-49249
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden
Boruta: OAuth credentials exposed in Boruta business logs
CVE-2026-55221
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden
Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
CVE-2026-53649
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1