Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_b...

CVE-2026-46539

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

历史摘要 · 未重新核验 · NVD

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

CVE-2026-47737

### Impact Puma is vulnerable to source IP spoofing when `set_remote_address proxy_protocol: :v1` is enabled and persis

历史摘要 · 未重新核验 · GitHub Advisory

Netty has Insufficient Bailiwick Validation for NS Records

CVE-2026-47691

### Summary Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoni

历史摘要 · 未重新核验 · GitHub Advisory

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

CVE-2026-45674

### Summary Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. ### D

历史摘要 · 未重新核验 · GitHub Advisory

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More...

CVE-2026-7792

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vu

历史摘要 · 未重新核验 · GitHub Advisory

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticit...

CVE-2026-7792

WordPress的WPForms插件（至1.10.0.1版本）存在数据真实性验证不足漏洞。其PayPal Commerce Webhook端点在处理JSON webhook负载时，未验证请求是否来自PayPal（缺少HMAC-SHA256

历史摘要 · 未重新核验 · NVD

The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable...

CVE-2026-8608

The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verifi

历史摘要 · 未重新核验 · GitHub Advisory

The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and includ...

CVE-2026-8608

The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verifi

历史摘要 · 未重新核验 · NVD

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1,...

CVE-2022-4992

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (wi

历史摘要 · 未重新核验 · GitHub Advisory

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (with VG4.2 partially affected) contain a network message ha...

CVE-2022-4992

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (wi

历史摘要 · 未重新核验 · NVD

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response processor (ResponseProcessor.parse()) does not validate the Con...

CVE-2026-41577

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response proces

历史摘要 · 未重新核验 · NVD

stigmem-node's federation peer registration lacked explicit out-of-band approval

### Impact Federation peer registration accepted peer key material during registration without a separate administrator

历史摘要 · 未重新核验 · GitHub Advisory

stigmem-node's federation peer token timestamp validation may reject valid peer tokens

### Impact A mismatch in federation peer-token timestamp handling could cause valid peer tokens to be treated as expired

历史摘要 · 未重新核验 · GitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails command has two cod...

CVE-2026-47123

FreeScout是一个基于PHP Laravel框架的免费帮助台和共享收件箱系统。在1.8.220之前的版本中，其邮件处理流水线（FetchEmails命令）存在两处代理用户回复识别代码路径，均依赖于In-Reply-To/Referen

历史摘要 · 未重新核验 · NVD

WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-con...

CVE-2026-47696

WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits t

历史摘要 · 未重新核验 · NVD

The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verification of Data Authenticity in all versions up to, and in...

CVE-2026-9189

The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Payment Bypass via Insufficient Verifi

历史摘要 · 未重新核验 · NVD

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's constellation client tracks pending task respo...

CVE-2026-46538

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Micro

历史摘要 · 未重新核验 · NVD

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

CVE-2026-45069

### Description `OidcTokenHandler` is Symfony's built-in access-token handler for OpenID Connect: it validates a bearer

历史摘要 · 未重新核验 · GitHub Advisory

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstr...

CVE-2026-45022

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may par

历史摘要 · 未重新核验 · NVD

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypt...

CVE-2026-3012

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabl

历史摘要 · 未重新核验 · NVD