Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An...
CVE-2026-14644
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with
#advisory
共收录 23530 条相关情报。
← 返回所有主题A user holding a permission to update privilege definitions could modify a wildcard privilege...
CVE-2026-17601
A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization...
CVE-2026-17594
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in th
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke...
CVE-2026-17600
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissio
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could...
CVE-2026-17603
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the Data
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account...
CVE-2026-17595
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:select
A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of...
CVE-2026-19212
A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WT
A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown...
CVE-2026-19211
A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /socia
A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD:...
CVE-2026-19208
A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src
A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is...
CVE-2026-19210
A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of
A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an...
CVE-2026-19209
A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
CVE-2026-67422
### Summary Four inline processors in pymdown-extensions contain regular expressions with exponential backtracking. A s
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
CVE-2026-63223
### Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable a
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
CVE-2026-63222
### Impact In affected versions, calling `UploadedFile::move()` **without a second argument** uses the client-provided f
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
CVE-2026-63221
### Impact A SQL injection vulnerability exists in the Query Builder's `deleteBatch()` method. When `deleteBatch()` is u
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
CVE-2026-63220
### Impact `IncomingRequest::isSecure()` trusted the `X-Forwarded-Proto` and `Front-End-Https` headers from any incoming
jsii-diff: Command Injection via npm: package argument
CVE-2026-15895
## Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report erro
Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
CVE-2026-56818
## Summary `RedisArrayAggregator` clears retained partial aggregate state when the `maxNestedArrayDepth` limit is excee
Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
CVE-2026-56818
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the Redis
API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)
CVE-2026-54164
## Summary The API Platform serializer's `AbstractItemNormalizer` does not validate the resource type returned when res