Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

CVE-2026-50558

### Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating a

历史摘要 · 未重新核验 · GitHub Advisory

Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type

CVE-2026-49756

### Summary Req's multipart form encoder interpolates the per-part `name`, `filename`, and `content_type` directly into

历史摘要 · 未重新核验 · GitHub Advisory

Req vulnerable to unbounded archive/compression extraction triggered by response content-type

CVE-2026-49755

### Summary Req's default response pipeline auto-decodes archive and compressed bodies based on the server-supplied `co

历史摘要 · 未重新核验 · GitHub Advisory

veraPDF Parser DoS via PostScript Type 1 Font Programs

CVE-2026-54081

## Summary **Description** A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allow

历史摘要 · 未重新核验 · GitHub Advisory

veraPDF Parser DoS via PostScript CMap Streams

CVE-2026-54080

## Summary **Description** A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allow

历史摘要 · 未重新核验 · GitHub Advisory

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

CVE-2026-54082

### Summary veraPDF-validation has an XML External Entity (XXE) vulnerability in two PDF parsing paths (validate and `G

历史摘要 · 未重新核验 · GitHub Advisory

veraPDF Validation XXE via Rich Text

CVE-2026-54078

## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote atta

历史摘要 · 未重新核验 · GitHub Advisory

veraPDF Validation XXE via XFA

CVE-2026-54079

## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote atta

历史摘要 · 未重新核验 · GitHub Advisory

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

CVE-2026-54666

### Summary `swagger-typescript-api` interpolates OpenAPI path strings (the keys of the `paths` object, e.g. `/users/{i

历史摘要 · 未重新核验 · GitHub Advisory

swagger-typescript-api vulnerable to code injection via unescaped enum string values

CVE-2026-54664

### Summary `swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generat

历史摘要 · 未重新核验 · GitHub Advisory

【云数据库 MySQL】关于接口传入只读组 ID（cdbrg-）资源鉴权策略优化的公告

【云数据库 MySQL】关于接口传入只读组 ID（cdbrg-）资源鉴权策略优化的公告

历史摘要 · 未重新核验 · 腾讯云安全公告

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable...

CVE-2026-17162

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc

历史摘要 · 未重新核验 · GitHub Advisory

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress

历史摘要 · 未重新核验 · GitHub Advisory

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable...

CVE-2026-17161

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc

历史摘要 · 未重新核验 · GitHub Advisory

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ...

CVE-2026-12939

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the p

历史摘要 · 未重新核验 · GitHub Advisory

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ...

CVE-2026-12938

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the

历史摘要 · 未重新核验 · GitHub Advisory

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all...

CVE-2026-12144

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl

历史摘要 · 未重新核验 · GitHub Advisory

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via...

CVE-2026-15735

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field'

历史摘要 · 未重新核验 · GitHub Advisory

goshs has ACL Bypass & Path Traversal

CVE-2026-66064

## Summary `sendFile` derives the served filename from the raw request path while opening the file from the cleaned pat

历史摘要 · 未重新核验 · GitHub Advisory

Pagy I18n locale option is not validated before being used in a file path

CVE-2026-54659

### Summary `Pagy::I18n.locale=` did not validate its argument before using it as a path component to load the matching

历史摘要 · 未重新核验 · GitHub Advisory