gitoxide before 0.69.0 Denial of Service via gix-pack
CVE-2026-82254
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-cont
#advisory
共收录 23717 条相关情报。
← 返回所有主题gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass
CVE-2026-82253
gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule n
gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
CVE-2026-82252
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-
gitoxide before 0.52.1 Path Traversal via Submodule Name
CVE-2026-82251
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when de
gitoxide gix-packetline before 0.21.5 Denial of Service
CVE-2026-82250
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs w
gitoxide before 0.38.2 Credential Helper Protocol Field Injection
CVE-2026-82249
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attacker
gitoxide before 0.33.0 Path Traversal via symlink following
CVE-2026-82248
gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_s
gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
CVE-2026-82247
gitoxide's gix-url crate (?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended h
Budibase Server before 3.41.3 SSRF via Query Import
CVE-2026-82246
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fai
Budibase before 3.41.3 Missing Authorization License Management
CVE-2026-82245
Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authentic
Budibase before 3.41.3 Remote Code Execution via Plugin eval()
CVE-2026-82244
Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticat
Budibase Server before 3.41.3 SSRF with Credential Leakage
CVE-2026-82243
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint tha
Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization
CVE-2026-82242
Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpo
Budibase backend-core SSRF via incomplete default blacklist
CVE-2026-82241
Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.
Budibase before 3.41.3 Privilege Escalation via User Update API
CVE-2026-82240
Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoi
Budibase before 3.41.3 Authorization Bypass via datasources/query
CVE-2026-82239
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowin
filebrowser through 2.63.23 Stale Share Link via File Rename
CVE-2026-82237
filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cl
File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion
CVE-2026-82236
File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes ano
filebrowser through 2.63.23 Denial of Service via named pipes
CVE-2026-82235
filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing at
SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU
CVE-2026-82234
SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agen