Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
CVE-2026-23603
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
#advisory
共收录 23530 条相关情报。
← 返回所有主题HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text b...
CVE-2022-4993
HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion beca
vLLM: Completion prompt lists fan out into unbounded engine requests
CVE-2026-73559
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions Complet
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574
CVE-2026-73556
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex paramet
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
CVE-2026-73555
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in
rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
CVE-2026-70452
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent host
rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
CVE-2026-70455
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resour
rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()
CVE-2026-70456
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicio
rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
CVE-2026-70459
rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remot
rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
CVE-2026-70460
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module roo
rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
CVE-2026-70463
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses co
rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall
CVE-2026-70464
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers
rsync < 3.5.0 Symlink Race Condition Directory Traversal
CVE-2026-53801
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows
rsync < 3.5.0 Symlink Race Condition via --remove-source-files
CVE-2026-53800
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows atta
rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application
CVE-2026-53799
rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply a
rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling
CVE-2026-53796
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon recei
rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest
CVE-2026-53795
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the inten
rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode
CVE-2026-53793
rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended in
rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block
CVE-2026-53792
rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a ma
rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
CVE-2026-53791
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to