共收录 65074 条相关情报。
← 返回所有主题CVE-2026-112904
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.
CVE-2026-107685
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path a
CVE-2026-89320
`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message unde
CVE-2026-89319
`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used
CVE-2026-89318
`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking
CVE-2026-89317
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to
CVE-2026-89316
`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK
CVE-2026-89315
`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimNam
CVE-2026-89314
`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost gr
CVE-2026-89313
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache.
CVE-2026-89312
`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go s
CVE-2026-25784
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image blues
CVE-2026-25716
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authentica
CVE-2025-58403
CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data.
CVE-2025-30054
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with roo
CVE-2025-30053
The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication.
CVE-2025-30052
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based s
CVE-2025-30051
The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials,
CVE-2025-30050
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified
CVE-2025-30049
The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 a