Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
CVE-2026-56821
### Summary `OcspServerCertificateValidator` flags an out-of-date OCSP response but does not stop processing it, so an e
#advisory
共收录 23779 条相关情报。
← 返回所有主题Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
CVE-2026-56820
### Summary Netty's OcspClient does not validate that the CertificateID in an OCSP response matches the requested Certif
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
CVE-2026-56817
Any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a DOCTYPE declar
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
CVE-2026-56816
### Summary Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the specified payload le
Netty: Security Control Bypass via CORS Short-Circuit Failure
CVE-2026-56746
### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin r
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
CVE-2026-56745
The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initia
User tags, filters and conditions allowed access to insufficiently restricted user fields....
CVE-2026-64794
User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose
Free did not require both the article creator and last modifier to be Super Users before...
CVE-2026-64796
Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did
Persistent URL login keys were also generated using a non-cryptographic random generator with...
CVE-2026-64798
Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy....
CVE-2026-64797
IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP
Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching...
CVE-2026-63265
Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissio
danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection
CVE-2026-16629
A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the
oclif JIT Plugin Entry child_process.exec os command injection
CVE-2026-16628
A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec o
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify
CVE-2026-13089
OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorith
Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow
CVE-2026-64829
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obta
CVE-2026-16624
CVE-2026-16624
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on
CVE-2026-65650
CVE-2026-65650
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.
Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service
CVE-2026-7328
Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CM
Onlook tRPC Insecure Direct Object Reference via multiple procedures
CVE-2026-65013
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows a
InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder
CVE-2026-65012
InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_fo