An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or...

CVE-2026-28201

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allo

历史摘要 · 未重新核验 · NVD

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.31.1.0 to before ver...

CVE-2026-41890

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

历史摘要 · 未重新核验 · NVD

Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServiceURL value direct...

CVE-2026-41670

Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO

历史摘要 · 未重新核验 · NVD

Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information

CVE-2026-42459

## Summary The free5GC UDM component fails to validate the `supi` path parameter in six GET handlers of the `nudm-sdm`

历史摘要 · 未重新核验 · GitHub Advisory

container: pf Rule Injection via Domain Name Argument in `container system dns create --localhost` Command

#### Product Name: container Github Link: https://github.com/apple/container Version: `**: exactly one rule is writte

历史摘要 · 未重新核验 · GitHub Advisory

Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)

CVE-2026-42579

# Security Vulnerability Report: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) ## 1. Vulnerability Sum

历史摘要 · 未重新核验 · GitHub Advisory

kanidmd_lib: Image upload validators run before authorization; PNG validator panics on malformed input

### Summary The `POST /v1/domain/_image` and `POST /v1/oauth2/{rs_name}/_image` handlers call `validate_image()` on the

历史摘要 · 未重新核验 · GitHub Advisory

ShellHub has crash-DoS via field injection in filter and sort-by parameters

CVE-2026-44425

## Summary The device list endpoint accepts user-controlled identifiers in two places that are passed directly as BSON/S

历史摘要 · 未重新核验 · GitHub Advisory

Insufficient validation of untrusted input in FedCM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromiu...

CVE-2026-8013

Insufficient validation of untrusted input in FedCM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to

历史摘要 · 未重新核验 · NVD

Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass ...

CVE-2026-8010

Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote att

历史摘要 · 未重新核验 · NVD

Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform privileg...

CVE-2026-8007

Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who

历史摘要 · 未重新核验 · NVD

Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed an attacker on the local network segment to bypass same origin policy via mali...

CVE-2026-8005

Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed an attacker on the lo

历史摘要 · 未重新核验 · NVD

Insufficient validation of untrusted input in TabGroups in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via malicious network traffic. (...

CVE-2026-8003

Insufficient validation of untrusted input in TabGroups in Google Chrome prior to 148.0.7778.96 allowed a remote attacke

历史摘要 · 未重新核验 · NVD

Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted H...

CVE-2026-8000

Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148.0.7778.96 allowed a

历史摘要 · 未重新核验 · NVD

Insufficient validation of untrusted input in Dialog in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform UI spo...

CVE-2026-7998

Insufficient validation of untrusted input in Dialog in Google Chrome prior to 148.0.7778.96 allowed a remote attacker w

历史摘要 · 未重新核验 · NVD

rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

CVE-2026-42327

`X509Ref::ocsp_responders` returns OCSP responder URLs from a certificate's AIA extension as `OpensslString`, whose `Der

历史摘要 · 未重新核验 · GitHub Advisory

Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access

CVE-2026-42613

# Bug Report: Registration Privilege Escalation via Missing Server-Side Validation of groups/access ## Summary The `Lo

历史摘要 · 未重新核验 · GitHub Advisory

In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An attacker could cr...

CVE-2026-40068

CVE-2026-40068 影响 Claude Code 版本 2.1.63 至 2.1.83。该漏洞存在于文件夹信任判定逻辑中：当处理 git worktree 时，代码未对 `commondir` 文件内容进行验证，直接使用了该文件指

历史摘要 · 未重新核验 · NVD

JupyterHub has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request

CVE-2026-42266

The allow-list of extensions that can be installed from PyPI Extension Manager (`allowed_extensions_uris`) is not correc

历史摘要 · 未重新核验 · GitHub Advisory

open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`

CVE-2026-42260

### Summary `src/utils/urlSafety.ts` exposes `isPublicHttpUrl` / `assertPublicHttpUrl`, used to gate the MCP `fetchWebCo

历史摘要 · 未重新核验 · GitHub Advisory