#cwe-20

共收录 1723 条相关情报。

漏洞预警2026-07-21 发布INFO

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14...

CVE-2026-1771

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFi

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-20 发布INFO

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related t...

CVE-2026-47255

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-89 #cwe-284 #cwe-319 #cwe-798

安全公告2026-07-20 发布INFO

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

CVE-2026-14631

### Impact An unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-20 #cwe-248 #severity:medium

安全公告2026-07-20 发布INFO

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for...

CVE-2026-58624

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-20 #severity:medium

漏洞预警2026-07-20 发布INFO

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provide...

CVE-2026-58624

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-20 发布INFO

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable prope...

CVE-2026-47198

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-639

漏洞预警2026-07-20 发布INFO

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not ...

CVE-2026-44978

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-125

漏洞预警2026-07-20 发布INFO

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sani...

CVE-2026-35048

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them d

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

安全公告2026-07-20 发布INFO

xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification

CVE-2026-44978

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-125 #cwe-20

安全公告2026-07-20 发布INFO

Piwigo RCE via PHP Code Injection into Config File in Installer

CVE-2026-35048

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them d

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-20

漏洞预警2026-07-20 发布INFO

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it ve...

CVE-2026-63428

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id,

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-915

安全公告2026-07-20 发布INFO

HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set

CVE-2026-63428

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id,

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-20 #cwe-915

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by upload...

CVE-2026-63734

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-20 发布HIGH

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding c...

CVE-2026-42566

CVE-2026-42566 是开源 mesh 网络解决方案 Meshtastic 的一个高危漏洞（CVSS 7.5）。该漏洞存在于 2.7.23.b246bcd 之前的固件版本中，由于对用户长名称（User.long_name）的编码验证

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-07-19 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended beha...

CVE-2026-63913

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on in

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-07-19 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings VCN encoder and decoder rings do not support 6...

CVE-2026-63856

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-07-19 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings VCN encoder and decoder rings do not support 6...

CVE-2026-63855

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-07-19 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings VCN encoder and decoder rings do not support 6...

CVE-2026-63854

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-07-19 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring VCN encoder and decoder rings do not support 64-bit...

CVE-2026-63853

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-07-19 发布HIGH

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring JPEG rings do not support 64-bit user fence writes, r...

CVE-2026-63848

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ri

来源摘录 · NVD

#cve #cwe-20