mathlive's Lack of Escaping of HTML allows for XSS

CVE-2026-54705

### Summary Despite the 0.104.0 patch escaping attribute-bearing constructs (`\htmlData`, `\href`), text-content reflec

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

CVE-2026-54704

OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements wh

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

CVE-2026-54712

The RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of

历史摘要 · 未重新核验 · GitHub Advisory

ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal

### Summary Active Record Tenanted's override of Active Storage's `DiskService#path_for` does not validate that the res

历史摘要 · 未重新核验 · GitHub Advisory

netfoil: Incorrect block responses could lead to localhost traffic

### Summary `0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfo

历史摘要 · 未重新核验 · GitHub Advisory

Logging operator has Fluentd configuration injection that allows remote code execution

CVE-2026-54680

### Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as `Flow` directly int

历史摘要 · 未重新核验 · GitHub Advisory

ZITADEL Users Can Self-Verify Email/Phone via API

CVE-2026-54693

### Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as veri

历史摘要 · 未重新核验 · GitHub Advisory

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

CVE-2026-54727

## Affected Component - **Package:** proot-distro - **Affected command:** `restore` - **Attack surface:** Host-side Ter

历史摘要 · 未重新核验 · GitHub Advisory

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

CVE-2026-54574

**Repository:** `termux/proot-distro` **Component:** `proot_distro/commands/install.py` → `_extract_plain_tar()`; also

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

CVE-2026-52838

## Summary Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking s

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

CVE-2026-52841

### Summary `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the se

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

CVE-2026-52837

## Summary The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::inde

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass

CVE-2026-52839

## Summary Easy!Appointments correctly filters provider-scoped appointments in the `appointments/search` response, pro

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

CVE-2026-52840

### Summary `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

CVE-2026-55651

### Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to ob

历史摘要 · 未重新核验 · GitHub Advisory

olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193

### Problem Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519

历史摘要 · 未重新核验 · GitHub Advisory

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

CVE-2026-11393

### Summary The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon

历史摘要 · 未重新核验 · GitHub Advisory

prebid-server's request forgery vulnerability allows for possible host environment data extraction

CVE-2026-54735

### Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Wit

历史摘要 · 未重新核验 · GitHub Advisory

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

CVE-2026-50559

Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parame

历史摘要 · 未重新核验 · GitHub Advisory

@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate

### Summary A missing human-approval gate on the `create_dynatrace_notebook` tool allows a caller to create persistent t

历史摘要 · 未重新核验 · GitHub Advisory