Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impers...

CVE-2026-117656

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth A

来源摘录 · NVD

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACL...

CVE-2026-112256

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allow

来源摘录 · NVD

gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

## Summary In the `gix` crate, `Cache::protect_options()` in `gix/src/config/cache/access.rs` reads the three filesyste

历史摘要 · 未重新核验 · GitHub Advisory

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19...

CVE-2026-100755

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 1

历史摘要 · 未重新核验 · GitHub Advisory

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configur...

CVE-2026-100755

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 1

历史摘要 · 未重新核验 · NVD

Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the compacted message stream from its inn...

CVE-2026-48100

Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, a

历史摘要 · 未重新核验 · NVD

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the ...

CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration fr

历史摘要 · 未重新核验 · NVD

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in ...

CVE-2026-54047

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior t

历史摘要 · 未重新核验 · NVD

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with the...

CVE-2026-74916

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its pa

历史摘要 · 未重新核验 · NVD

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

CVE-2026-54625

### Summary The CMS page cache key ignores the request headers that plugins declare via `get_vary_cache_on()`. The heade

历史摘要 · 未重新核验 · GitHub Advisory

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by pl...

CVE-2026-54625

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in

历史摘要 · 未重新核验 · NVD

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. Wh...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret

历史摘要 · 未重新核验 · NVD

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with rem...

CVE-2026-41120

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trust

历史摘要 · 未重新核验 · NVD

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.

CVE-2026-33612

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.

历史摘要 · 未重新核验 · NVD

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to ...

CVE-2026-46342

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 t

历史摘要 · 未重新核验 · NVD

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replie...

CVE-2026-42960

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authori

历史摘要 · 未重新核验 · NVD

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

CVE-2026-46342

### Summary The `/__nuxt_island/*` endpoint accepts attacker-controlled `props` query/body parameters and renders any i

历史摘要 · 未重新核验 · GitHub Advisory

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal...

CVE-2026-44572

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an exte

历史摘要 · 未重新核验 · NVD