Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into...
CVE-2026-77115
Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without
#severity:high
共收录 5383 条相关情报。
← 返回所有主题chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in...
CVE-2026-78136
chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/ken
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function...
CVE-2026-78050
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-b
docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace...
CVE-2026-78122
docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS en
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in...
CVE-2026-0551
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and
The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions...
CVE-2026-16149
The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including,
In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that...
CVE-2026-47895
In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but no
PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting...
CVE-2026-77220
PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated...
CVE-2026-76876
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sens
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20,...
CVE-2026-67359
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauth
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4...
CVE-2026-74252
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2
Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
CVE-2026-68508
## Summary `hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untruste
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
CVE-2026-63135
### Summary YOURLS stores the HTTP `Referer` header for short URL redirects and later renders aggregated referrer domai
kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
CVE-2026-77354
### Summary An uncontrolled resource consumption vulnerability in `openapi3filter` lets any unauthenticated client forc
kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
CVE-2026-76905
### Summary A nil-pointer dereference in `openapi3filter.ConvertErrors` lets any unauthenticated client crash a server
Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation
CVE-2026-64679
### Summary Atlantis versions `>= 0.19.8` and `< 0.45.0` did not consistently validate user-controlled `workspace` value
Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
CVE-2026-63421
# Summary The value of `graphql.maxTake` can be bypassed by providing a negative input. This can be used to exceed the d
Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
CVE-2026-61824
## Summary An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
CVE-2026-63462
## Summary An unauthenticated `POST` to any OpenAPI-validated endpoint, including the anonymous `POST /edge/validate` a
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection...
CVE-2026-41451
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substi