Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO
CVE-2026-53985
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's serv
#advisory
共收录 23530 条相关情报。
← 返回所有主题Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service
CVE-2026-68750
Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenti
Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service
CVE-2026-68749
Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthe
CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input
CVE-2026-68747
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the
html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection
CVE-2026-66829
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allow
html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking
CVE-2026-66370
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allow
html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
CVE-2026-66843
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex
aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
CVE-2026-70646
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` d
MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection
CVE-2026-19041
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageSe
Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache
CVE-2026-66733
Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enque
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
CVE-2026-64604
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update if
smb/client: Fix error code in smb2_aead_req_alloc()
CVE-2026-64598
In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2_aead_req_alloc()
libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
CVE-2026-64596
In the Linux kernel, the following vulnerability has been resolved: libfs: set SB_I_NOEXEC and SB_I_NODEV by default in
HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
CVE-2026-64595
In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfg_setup work in hid_go
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
CVE-2026-64587
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: arc: emac: quiesce interrupts before
TinyAGI Message API Endpoint index.ts processMessage authorization
CVE-2026-19010
A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packag
【TDSQL PostgreSQL 版公有云服务 】停止售卖公告
【TDSQL PostgreSQL 版公有云服务 】停止售卖公告
【智能体开发平台 ADP】关于 youtu-agent 及 youtu-mrc-pro 模型升级及切换安排的公告
【智能体开发平台 ADP】关于 youtu-agent 及 youtu-mrc-pro 模型升级及切换安排的公告
【TDSQL-C MySQL 版】多可用区部署商业化公告
【TDSQL-C MySQL 版】多可用区部署商业化公告
Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows...
CVE-2026-18907
Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via direc