Ghost: Server-Side Request Forgery in Bookmark Fetching
CVE-2026-105647
### Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user
#cwe-367
共收录 358 条相关情报。
← 返回所有主题Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address ...
CVE-2026-89430
Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was
yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file bu...
CVE-2026-106451
yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.cre
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not ne...
CVE-2026-101029
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS a
Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page...
CVE-2026-106413
Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the rend
Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to p...
CVE-2026-106412
Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised t
Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium securit...
CVE-2026-106405
Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass we
Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via ...
CVE-2026-106300
Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s...
CVE-2026-106207
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail w...
CVE-2026-93315
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause clea
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in ...
CVE-2026-105743
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos
Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated us...
CVE-2026-105647
Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, s
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the installation of the HTT...
CVE-2026-77804
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOC
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component Imag...
CVE-2026-105163
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function
crossplane crossplane-runtime ImageConfig client.go Get toctou
CVE-2026-105163
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function
LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in...
CVE-2026-105130
LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allow
LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass the per-IP daily re...
CVE-2026-105130
LaraDashboard 在 1.4.0 起至 1.4.8 之前的版本中，注册流程 RegisterController::register 存在竞态条件（race condition）问题。该组件原本设计了基于来源 IP 的每日注册次数
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup...
CVE-2026-104474
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverifie
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as roo...
CVE-2026-104474
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverifie
Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page...
CVE-2026-95360
Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineerin