共收录 69535 条相关情报。
← 返回所有主题CVE-2026-9817
A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLI
CVE-2026-9814
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK
CVE-2026-9660
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (ve
CVE-2026-9659
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (ve
CVE-2026-94266
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentia
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously
CVE-2026-92391
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal
CVE-2026-92390
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an
CVE-2026-92389
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting ope
CVE-2026-92388
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving t
CVE-2026-92387
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl
CVE-2026-92386
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record
CVE-2026-87866
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not pos
CVE-2026-87865
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to
CVE-2026-87864
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmi
CVE-2026-87863
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later f
CVE-2026-87862
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequen
CVE-2026-87861
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previous
CVE-2026-86415
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already
CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) t