TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)
CVE-2026-54509
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src
#advisory
共收录 23530 条相关情报。
← 返回所有主题TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution
CVE-2026-54508
TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect follo
CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`
CVE-2026-55769
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and
LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API
CVE-2026-49436
LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /ap
Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect
CVE-2026-50192
Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload
BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
CVE-2026-55489
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentation
BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
CVE-2026-55491
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
CVE-2026-67448
## Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test,
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
CVE-2026-67447
## Summary Mailpit's SMTP DATA reader enforces the configured `MaxMessageSize` only after `bufio.Reader.ReadBytes('\n')
BigBlueButton: Blind SQL Injection AUTH (Moderator)
CVE-2026-46682
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to in
Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode
CVE-2026-55893
Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point
Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode
CVE-2026-55894
Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() f
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
CVE-2026-67448
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin mid
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
CVE-2026-67447
Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go rea
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
CVE-2026-67445
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/s
OTRS Community Edition OS Command Injection via PGP Configuration
CVE-2026-53804
OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that al
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
CVE-2026-67446
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attach
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
CVE-2026-68921
DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate optio
libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow
CVE-2026-70654
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unus
libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance image
CVE-2026-70653
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE de