vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their...

CVE-2026-119568

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated at

来源摘录 · NVD

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remo...

CVE-2026-112408

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SD

来源摘录 · NVD

Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

CVE-2026-112408

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SD

历史摘要 · 未重新核验 · OSV.dev

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

CVE-2026-76894

## Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates

历史摘要 · 未重新核验 · GitHub Advisory

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTool...

CVE-2026-101897

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

来源摘录 · NVD

Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.

CVE-2026-87705

Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass

来源摘录 · NVD

Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affec...

CVE-2026-94590

Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads al

历史摘要 · 未重新核验 · NVD

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix tr...

CVE-2026-59786

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authen

历史摘要 · 未重新核验 · NVD

On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could ...

CVE-2026-102117

On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who al

历史摘要 · 未重新核验 · NVD

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the t...

CVE-2026-89178

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unau

历史摘要 · 未重新核验 · NVD

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communic...

CVE-2026-85085

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who

历史摘要 · 未重新核验 · NVD

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a craft...

CVE-2026-78685

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote

历史摘要 · 未重新核验 · NVD

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, ...

CVE-2026-73419

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth

历史摘要 · 未重新核验 · NVD

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

## Summary Auth.js stores the OAuth/OIDC anti-CSRF checks (`state`, `nonce`, and the PKCE verifier) in global cookies t

历史摘要 · 未重新核验 · GitHub Advisory

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypas...

CVE-2026-55660

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin po

历史摘要 · 未重新核验 · NVD

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

CVE-2026-55660

TinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and th

历史摘要 · 未重新核验 · GitHub Advisory

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and...

CVE-2026-54106

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac

历史摘要 · 未重新核验 · GitHub Advisory

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not...

CVE-2026-54106

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac

历史摘要 · 未重新核验 · NVD

Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prio...

CVE-2026-44894

Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the toke

历史摘要 · 未重新核验 · NVD

@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

CVE-2026-48022

### Impact Wreck strips credential headers (Authorization, Cookie, Proxy-Authorization) before following a cross-origin

历史摘要 · 未重新核验 · GitHub Advisory