Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone (<LFS-root>/<oid[0]>/<oid[1]>/<oid>) but per-repo authorizatio...

CVE-2026-52812

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone (///)

历史摘要 · 未重新核验 · NVD

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all artifacts loaded for...

CVE-2026-47155

vLLM 是一个用于大语言模型（LLM）的推理和服务引擎。在版本 0.22.0 之前，vLLM 的修订版本固定（revision pinning）控制未能一致地应用于模型加载的所有组件。具体而言，当部署时通过 --revision 或 --

历史摘要 · 未重新核验 · NVD

AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

CVE-2026-33731

## Summary The Authorize.Net webhook handler at `plugin/AuthorizeNet/webhook.php` contains a signature verification byp

历史摘要 · 未重新核验 · GitHub Advisory

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to d...

CVE-2026-54288

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit M

历史摘要 · 未重新核验 · NVD

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, Angula...

CVE-2026-54266

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

历史摘要 · 未重新核验 · NVD

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that...

CVE-2026-56073

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypa

历史摘要 · 未重新核验 · GitHub Advisory

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Atta...

CVE-2026-56073

Cap-go 是一个开源的认证与授权库（Go 语言），用于处理用户注册、登录、两因素认证（2FA）等。在版本 12.128.2 之前，其 OTP（一次性密码）验证功能存在严重的安全漏洞。攻击者无需任何身份验证即可通过网络远程利用该漏洞。具体

历史摘要 · 未重新核验 · NVD

http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`

### Impact The `HmacSha256` class contained two functions: - `hash(payload)` — a plain unkeyed SHA-256 digest. The `Hma

历史摘要 · 未重新核验 · GitHub Advisory

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

## Summary Crossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enab

历史摘要 · 未重新核验 · GitHub Advisory

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface that allows the attac...

CVE-2026-44087

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default

历史摘要 · 未重新核验 · NVD

PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

## Summary `JWSVerifier::getAlgorithm()` in `src/Library/Signature/JWSVerifier.php` (line 144) merges protected and unp

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can...

CVE-2026-53862

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to

历史摘要 · 未重新核验 · NVD

Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies i...

CVE-2026-53900

Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument

历史摘要 · 未重新核验 · NVD

Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site...

CVE-2026-53899

Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suff

历史摘要 · 未重新核验 · NVD

Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented to be featured in ...

CVE-2026-47777

Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in

历史摘要 · 未重新核验 · NVD

Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an authenticated user to enable an escalation...

CVE-2026-53406

Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.

历史摘要 · 未重新核验 · NVD

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insuffici...

CVE-2026-47691

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

历史摘要 · 未重新核验 · NVD

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to va...

CVE-2026-45674

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

历史摘要 · 未重新核验 · NVD

OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning

CVE-2026-48096

### Description In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key

历史摘要 · 未重新核验 · GitHub Advisory

Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce...

CVE-2026-46654

Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side

历史摘要 · 未重新核验 · NVD