libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map

CVE-2026-70652

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahd

历史摘要 · 未重新核验 · OSV.dev

libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write

CVE-2026-69242

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF proc

历史摘要 · 未重新核验 · OSV.dev

Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

CVE-2026-73040

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requ

历史摘要 · 未重新核验 · OSV.dev

gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

CVE-2026-55451

### Impact `js2i18next()` is vulnerable to prototype pollution. When converting translations, it splits nested keys on

历史摘要 · 未重新核验 · GitHub Advisory

Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

CVE-2026-72861

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. ver

历史摘要 · 未重新核验 · OSV.dev

lin-snow Ech0 crypto.go MD5Encrypt risky encryption

CVE-2026-77151

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of t

历史摘要 · 未重新核验 · OSV.dev

Wagtail: Improper restriction handling on Page translation API endpoint

### Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoi

历史摘要 · 未重新核验 · GitHub Advisory

Wagtail: Improper permission handling when copying snippets

### Impact A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an e

历史摘要 · 未重新核验 · GitHub Advisory

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

### Impact The Documents and Images [API V2](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorre

历史摘要 · 未重新核验 · GitHub Advisory

Wagtail: Identification of documents by SHA1 hash

### Impact By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whethe

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Reflected XSS through the search query parameter in the backend Table widget

### Impact Affected versions of Winter CMS render the `search` query parameter without HTML encoding inside a `` block

历史摘要 · 未重新核验 · GitHub Advisory

Winter: CSRF through AJAX handler names reachable as backend page actions

### Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level `GET` naviga

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

### Impact Users with the `backend.manage_branding` ("Customize the back-end") or `backend.manage_editor` ("Manage glob

历史摘要 · 未重新核验 · GitHub Advisory

Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

### Impact Affected versions of Winter CMS did not enforce the `ImportExportController` behavior's granular access cont

历史摘要 · 未重新核验 · GitHub Advisory

Winter: My Account preview exposes another backend user's profile by record ID

### Impact `Backend\Controllers\MyAccount`, introduced in v1.2.13, declares an empty `$requiredPermissions` array so th

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Stored XSS through Backend List widget image columns

### Impact `Backend\Widgets\Lists::evalImageTypeValue()` interpolated the resolved image URL into a single-quoted `src`

历史摘要 · 未重新核验 · GitHub Advisory

Fleet: ORDER BY column injection on activity list endpoints

### Summary An authenticated user with read access to Activity could influence the `ORDER BY` clause of the activity li

历史摘要 · 未重新核验 · GitHub Advisory

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs

### Summary Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reacha

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

### Impact Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to e

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

### Impact Affected versions of Winter CMS allow authenticated backend users with the `cms.manage_assets` permission ("

历史摘要 · 未重新核验 · GitHub Advisory