tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service
A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Read
#advisory
共收录 23507 条相关情报。
← 返回所有主题postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service
A malicious or compromised server can return a binary `hstore` value with an invalid internal length field, causing the
postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration cou
Sakai Profile Image Deletion has an IDOR
CVE-2026-54050
### Summary The Sakai REST API endpoint `DELETE /api/users/{userId}/profile/image` does not verify that the requesting
Sakai Conversations has a Stored XSS Issue
CVE-2026-54049
### Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend ren
Hi.Events validates a webhook destination only when it is registered, never when it is used....
CVE-2026-76838
Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backen
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX...
CVE-2026-78475
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin al
Baserow interpolates a user's display name into the rich-text mention markup without HTML...
CVE-2026-76837
Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/acco
An unauthenticated OS command injection vulnerability exists in the parental control...
CVE-2026-9254
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, B
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may...
CVE-2026-76835
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, b
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands...
CVE-2026-76072
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattende
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-71982
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet...
CVE-2026-71943
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerabili
Label Studio does not scope the annotation detail endpoint to the requesting user's organization....
CVE-2026-76073
Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not...
CVE-2026-76836
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission gu
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert...
CVE-2026-71942
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerab
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple...
CVE-2026-71933
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vul
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the...
CVE-2026-71938
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnera
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the...
CVE-2026-71939
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. T
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot...
CVE-2026-71936
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability