Payload: SQL Injection in SQLite and Postgres
CVE-2026-105845
### Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - Y
#severity:critical
共收录 1449 条相关情报。
← 返回所有主题MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
CVE-2026-105794
# Summary Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic. # Details Only MsQu
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted...
CVE-2026-105484
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the functio
h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira...
CVE-2026-21589
h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Cent
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an...
CVE-2026-91107
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record thr
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
CVE-2026-102829
# Security control bypass in `@simple-git/argv-parser`: Git's `VISUAL` editor fallback is not classified as `allowUnsafe
simple-git unsafe-operation guard does not block trailer command configuration
CVE-2026-102828
## Affected product The default `blockUnsafeOperationsPlugin` in `simple-git` when an application permits untrusted val
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
CVE-2026-104846
A fulfilled Promise node deserialized by `fromJSON()` can trigger unintended invocation of a plugin-produced callable th
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
CVE-2026-90711
### Impact `proxy-addr` determines which network hops are trusted proxies so that `X-Forwarded-For` can be believed. Wh
vm2: NodeVM custom resolution bypasses external path boundaries
CVE-2026-100721
## Summary At source revision `91034466bfb7f56b95fd48083ec6ca36d058f164` of vm2 3.11.8, an untrusted `NodeVM` guest can
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that...
CVE-2026-105293
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Disc
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in...
CVE-2026-105223
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeco
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script...
CVE-2026-105294
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to w
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification...
CVE-2026-105222
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that...
CVE-2026-105221
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows...
CVE-2026-105216
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to imperso
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client...
CVE-2026-105218
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-th
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users...
CVE-2026-105089
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows...
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login...
CVE-2026-105215
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'ext