#advisory

共收录 23636 条相关情报。

← 返回所有主题
安全公告2026-07-28 发布INFO

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

CVE-2026-61609

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limite

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling

CVE-2026-66752

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

CVE-2026-54593

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2,

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

CVE-2026-43910

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. Fro

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

CVE-2026-66751

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to ar

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

CVE-2026-45293

WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route

CVE-2026-66750

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to dow

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler

CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup

CVE-2026-66749

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash th

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

CVE-2026-66748

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows user

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

@wakaru/cli arbitrary file write during bundle unpack

CVE-2026-54545

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlle

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Open Redirect in MISP Installer-Generated Apache Configuration

CVE-2026-67178

MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-t

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick

CVE-2026-67174

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Apache Axis2/Java: deserialization of untrusted Data

CVE-2026-66713

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Foundation Ap

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests

CVE-2026-67173

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG i

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service

CVE-2026-66922

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References

CVE-2026-66921

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpol

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

CVE-2026-66920

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affec

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

Stored DOM-Based Cross-Site Scripting in Node Modal Headers

CVE-2026-66919

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-28 发布INFO

nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure

CVE-2026-18038

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.E

历史摘要 · 未重新核验 · OSV.dev