Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens
CVE-2026-49447
### Summary `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that s
#advisory
共收录 23636 条相关情报。
← 返回所有主题Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
CVE-2026-50568
`SanitizeFilePath` in `pkg/utils/utils.go` validated that a path stayed under a safe directory by calling `strings.HasPr
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
CVE-2026-50567
`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and
Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
CVE-2026-50569
`HTTPTriggerSpec.Validate()` validated `Methods`, `FunctionReference`, `Host`, `IngressConfig`, and `CorsConfig`, but si
Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption
CVE-2026-50570
Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs (`ValidatePodSpecSafety`
Dompdf: File existence oracle via font-face stylesheet declaration
CVE-2026-55555
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack thr
SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title
CVE-2026-57511
SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject
SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC
CVE-2026-57510
SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers t
Litestar: HTML Injection Through CSRF Token
CVE-2026-48060
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which
Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
CVE-2026-49258
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*
nebula-mesh: Session and OIDC state cookies lack the Secure attribute
CVE-2026-48058
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, intern
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated...
CVE-2026-67185
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary fi
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 APIC frame...
CVE-2026-51275
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 APIC frame parsing function in audiolib
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers...
CVE-2026-67183
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available me
Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that...
CVE-2026-48388
Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in
Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in...
CVE-2026-48372
Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution i
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized...
CVE-2026-51274
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audio
nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
CVE-2026-47768
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-
PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
CVE-2026-59932
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 t
nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
CVE-2026-47726
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, intern