共收录 259 条相关情报。
← 返回所有主题CVE-2026-55857
### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in
CVE-2026-55856
### Summary When a Java application connects with sslMode=verify-full (or verify-ca) and a password but does not pin a
CVE-2026-55848
### Summary XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs
CVE-2026-55867
### Impact Graylog contains an insecure direct object reference (IDOR) vulnerability in the token revocation endpoint.
CVE-2026-55841
### Impact A security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-valu
CVE-2026-55688
### Impact A **cookie tossing / cookie injection** issue (CWE-1275). `ThreadSafeCookieStore` stored a cookie under the
CVE-2026-54550
### Summary IzPack's `UnpackerBase.unpack()` resolves pack-file target paths without any canonical-path or directory-co
CVE-2026-54556
### Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack
CVE-2026-54050
### Summary The Sakai REST API endpoint `DELETE /api/users/{userId}/profile/image` does not verify that the requesting
CVE-2026-54049
### Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend ren
CVE-2026-76904
### Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementat
CVE-2026-63202
# BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding - **ID:** BHTTP-LOOP
CVE-2026-61827
We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these
CVE-2026-63124
## Summary `io.netty.incubator:netty-incubator-codec-bhttp` can enter a non-terminating parse loop when a known-length
CVE-2026-61799
## Summary `io.netty.incubator:netty-incubator-codec-bhttp` uses attacker-controlled Binary HTTP variable-length intege
CVE-2026-61798
## Summary `io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` exposes raw HPKE private key bytes i
CVE-2024-45747
### Summary A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to up
CVE-2026-53966
### Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that
CVE-2026-54148
### Impact An issue in `DigestAuthProvider.verify`: The `uri` parameter in the client's `Authorization: Digest …` resp
CVE-2026-54147
### Impact An issue in `DigestAuthProvider.verify`: **Algorithm silently forced to MD5.** The configured `algorithm`