A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the...
CVE-2026-18631
A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig
#advisory
共收录 23627 条相关情报。
← 返回所有主题Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing...
CVE-2026-59913
Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Criti
A cryptographic weakness exists in affected Omada devices where site credentials are protected...
CVE-2025-15631
A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing al
A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the...
CVE-2026-18644
A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /
A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the...
CVE-2026-18632
A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header...
CVE-2026-38444
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is
A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard...
CVE-2025-15627
A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to
A cryptographic weakness exists in the Omada device adoption process. During adoption,...
CVE-2025-15544
A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials assoc
Affected Omada devices rely on embedded certificates that are shared across deployments to...
CVE-2025-15628
Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between contr
A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used...
CVE-2025-15629
A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communicati
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
CVE-2026-69248
### Summary If an intermediate constrained CA permits the DNS name `foo.example.com`, and the leaf certificate has a wil
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
CVE-2026-69249
### Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the pro
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
CVE-2026-69247
### Summary `pkcs7_decrypt_der`, `pkcs7_decrypt_pem`, and `pkcs7_decrypt_smime` reported the outcome of decrypting a `R
Guzzle: Noncanonical host can bypass host-based checks
CVE-2026-69246
### Impact In affected versions, Guzzle gives a transport the request URI as text and supplies the `Host` header separa
Guzzle: Noncanonical cookie domain keeps subdomain scope
CVE-2026-69245
### Impact `SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
CVE-2026-69244
### Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malfo
AIOHTTP: HTTP request smuggling via WebSocket upgrade
CVE-2026-69243
### Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. ### Impact
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
CVE-2026-59881
### Summary The client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extensi
Sequelize: SQL Injection (Oracle DB)
CVE-2026-69240
### Summary SQL Injection is possible with strings only **if dialect is set to `oracle`**. The vulnerability was confirm
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
CVE-2026-69207
### Summary The built-in CORS middleware (`hono/cors`) parses the attacker-controlled `Access-Control-Request-Headers`