A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern express...

CVE-2026-114653

A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers

来源摘录 · NVD

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

CVE-2026-111057

### Summary A missing comma in `mercury_app/block_handler.py`'s `BLOCKED_PATTERNS` list causes the blocklist to fail to

历史摘要 · 未重新核验 · GitHub Advisory

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab...

CVE-2026-111057

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4,

来源摘录 · NVD

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] f...

CVE-2026-54506

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5

历史摘要 · 未重新核验 · NVD

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access...

CVE-2026-88021

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a serv

历史摘要 · 未重新核验 · NVD

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .ne...

CVE-2026-73425

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remo

历史摘要 · 未重新核验 · NVD

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo an...

CVE-2026-64655

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate S

历史摘要 · 未重新核验 · NVD

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

## Summary The `@astrojs/netlify` adapter converts each `image.remotePatterns` entry into a regular expression that is

历史摘要 · 未重新核验 · GitHub Advisory

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route param...

CVE-2026-45065

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.4

历史摘要 · 未重新核验 · NVD

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within...

CVE-2026-56021

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due

历史摘要 · 未重新核验 · GitHub Advisory

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.

CVE-2026-56021

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due

历史摘要 · 未重新核验 · NVD

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP ...

CVE-2026-47674

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restricti

历史摘要 · 未重新核验 · NVD

Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.ts route patterns a...

CVE-2026-48147

Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages

历史摘要 · 未重新核验 · NVD

Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

CVE-2026-45065

### Description Symfony routes can declare a requirements regex per path parameter, e.g. a route `/{_locale}/blog` with

历史摘要 · 未重新核验 · GitHub Advisory