bunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb

CVE-2026-54728

bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb

历史摘要 · 未重新核验 · OSV.dev

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the...

CVE-2026-46341

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation

历史摘要 · 未重新核验 · NVD

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is...

CVE-2026-50012

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handli

历史摘要 · 未重新核验 · NVD

Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

CVE-2026-46341

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation

历史摘要 · 未重新核验 · OSV.dev

Squid: Memory corruption in cache_digest reply handling

CVE-2026-50012

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handli

历史摘要 · 未重新核验 · OSV.dev

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt...

CVE-2026-11386

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools).

历史摘要 · 未重新核验 · NVD

serde_with: KeyValueMap serialization panics on empty sequence or map entries

### Summary The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use

历史摘要 · 未重新核验 · GitHub Advisory

Pixeldrain API key shared with unverified thirdparty sites

CVE-2026-54254

### Summary When processing Pixeldrain URLs, `cyberdrop-dl-patched` could send an `Authorization` header that includes

历史摘要 · 未重新核验 · GitHub Advisory

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region va...

CVE-2026-56678

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key

历史摘要 · 未重新核验 · NVD

9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

CVE-2026-56678

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key

历史摘要 · 未重新核验 · OSV.dev

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an o...

CVE-2026-50144

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434

历史摘要 · 未重新核验 · NVD

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a ...

CVE-2026-40958

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of

历史摘要 · 未重新核验 · NVD

MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs

CVE-2026-52883

Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. Th

历史摘要 · 未重新核验 · GitHub Advisory

Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly...

CVE-2026-14961

Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sen

历史摘要 · 未重新核验 · GitHub Advisory

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS...

CVE-2026-20153

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has c

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoi...

CVE-2026-53513

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin'

历史摘要 · 未重新核验 · NVD

Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher...

CVE-2026-14961

Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sen

历史摘要 · 未重新核验 · NVD

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized ac...

CVE-2026-59955

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

历史摘要 · 未重新核验 · NVD

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized ac...

CVE-2026-59954

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

历史摘要 · 未重新核验 · NVD

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This r...

CVE-2026-20153

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has c

历史摘要 · 未重新核验 · NVD