#cwe-20

共收录 1723 条相关情报。

漏洞预警2026-08-23 发布INFO

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_pas...

CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_st

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-22 发布INFO

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This i...

CVE-2026-2996

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Valida

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-21 发布MEDIUM

OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not exp...

CVE-2026-53541

CVE-2026-53541 是 OliveTin（一个通过 Web 界面提供预定义 shell 命令的工具）中的漏洞。OliveTin 的执行器中的 filterToDefinedArgumentsOnly 函数本意是丢弃未在 actio

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-21 发布INFO

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument d...

CVE-2026-63421

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-480

安全公告2026-08-21 发布INFO

Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

CVE-2026-63421

# Summary The value of `graphql.maxTake` can be bypassed by providing a negative input. This can be used to exceed the d

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-20 #cwe-480 #severity:high

漏洞预警2026-08-21 发布INFO

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a craft...

CVE-2026-48769

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the I

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-21 发布INFO

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in...

CVE-2026-48755

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided ba

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-21 发布INFO

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically sele...

CVE-2026-77710

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

安全公告2026-08-21 发布INFO

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC...

CVE-2026-77645

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerabili

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-20 #severity:critical

安全公告2026-08-21 发布INFO

Improper input validation and Exposure of sensitive information through data queries...

CVE-2026-16520

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-20 #severity:high

安全公告2026-08-21 发布INFO

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose...

CVE-2026-70105

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a networ

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-20 #severity:medium

漏洞预警2026-08-21 发布INFO

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V...

CVE-2026-16520

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-202

漏洞预警2026-08-20 发布INFO

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrus...

CVE-2026-77645

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerabili

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-502

漏洞预警2026-08-20 发布INFO

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

CVE-2026-70105

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a networ

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-20 发布INFO

A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a s...

CVE-2026-66785

A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from o

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-20 发布INFO

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior ...

CVE-2026-53587

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-125 #cwe-126 #cwe-1284

漏洞预警2026-08-20 发布INFO

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, ...

CVE-2026-43678

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-770

安全公告2026-08-20 发布INFO

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security...

CVE-2026-76387

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-20 #severity:high

漏洞预警2026-08-19 发布INFO

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mc_investigation_read capability could inject Search Pro...

CVE-2026-76387

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-19 发布INFO

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Worksp...

CVE-2026-76332

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-20