An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to...
CVE-2026-51385
An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code v
#advisory
共收录 23779 条相关情报。
← 返回所有主题Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote...
CVE-2026-51025
Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary
The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name...
CVE-2024-51316
The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /g
A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element...
CVE-2026-16324
A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function
FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in...
CVE-2026-51031
FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. T
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is...
CVE-2026-12900
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-S
An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C...
CVE-2026-52656
An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an a
The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function...
CVE-2024-51314
The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/se
The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function...
CVE-2024-51312
The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/Se
The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function...
CVE-2024-51315
The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/Se
Guzzle: URI fragments disclosed in redirect Referer headers
### Impact When the optional `referer` redirect setting is enabled, affected versions of `RedirectMiddleware` can copy
Guzzle: Host-only cookie scope is not preserved
### Impact In affected versions, `CookieJar` does not preserve whether a response cookie was set without a `Domain` att
Guzzle: Unbounded response cookies risk denial of service
### Impact In affected versions, Guzzle's built-in `CookieJar` accepts any number of `Set-Cookie` header fields from on
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
## Summary In the composable `astro/hono` pipeline, the `security.checkOrigin` protection is only installed by the `mid
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
## Summary The `@astrojs/netlify` adapter converts each `image.remotePatterns` entry into a regular expression that is
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
CVE-2026-12590
### Impact When body-parser is configured with an invalid `limit` option value, such as an unparseable string or `NaN`,
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
CVE-2026-59730
### Impact With `trailingSlash: 'always'` configured, the `@astrojs/node` standalone server's static file handler appen
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
CVE-2026-59729
## Summary The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()`
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
CVE-2026-59728
## Summary In `@astrojs/rss`, the `source.title` and `enclosure.type` item fields are interpolated directly into XML te
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
CVE-2026-59727
### Summary When a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a cl