An attacker in a privileged network position may be able to leak sensitive information. A path...
CVE-2026-20685
An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addres
#cwe-20
共收录 1738 条相关情报。
← 返回所有主题Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-45495
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-45492
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security featur
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
CVE-2026-45678
### Summary The Postgres protocol parser assumes `BIND` message payloads contain a valid NUL-terminated portal name. A
OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent
CVE-2026-45676
### Summary OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A
An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addressed with improved validation. This issue is fixed in PCC ...
CVE-2026-20685
An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addres
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
### Impact If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver
A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of...
CVE-2026-8759
A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic
A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl...
CVE-2026-8759
A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic
A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function...
CVE-2026-8751
A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, an application-wide Cross-Site Request Forgery (CSRF) vulnerab...
CVE-2026-45317
Open WebUI 是一个自托管的人工智能平台，设计为完全离线运行。在 0.9.3 版本之前，其图像上传功能存在一个应用程序范围内的跨站请求伪造（CSRF）漏洞。攻击者可以通过设置一个指向恶意端点的图像 URL，诱使受害者查看该图像（例如
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
CVE-2026-45062
### Summary The `splitPos()` function in [`cgi.go`](https://github.com/php/frankenphp/blob/main/cgi.go) misuses `golang
Improper input validation within the AMD Platform Management Framework (PMF) could allow an...
CVE-2025-29936
Improper input validation within the AMD Platform Management Framework (PMF) could allow an attacker to unmap arbitrary
Improper input validation within the AMD Platform Management Framework (PMF) could allow an attacker to unmap arbitrary memory pages potentially impacting integrity and availabi...
CVE-2025-29936
Improper input validation within the AMD Platform Management Framework (PMF) could allow an attacker to unmap arbitrary
Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168...
CVE-2026-8579
Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker wh
Insufficient validation of untrusted input in GPU in Google Chrome prior to 148.0.7778.168...
CVE-2026-8538
Insufficient validation of untrusted input in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who
Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168...
CVE-2026-8527
Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attack
Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0...
CVE-2026-8536
Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remo
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's...
CVE-2026-42327
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_re
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
# Summary When a user signs in via OAuth, Open WebUI fetches the `picture` claim URL, infers a MIME type from the URL e