Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ...
CVE-2026-67585
Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthent
#severity:high
共收录 5387 条相关情报。
← 返回所有主题A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote...
CVE-2026-20345
A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c
An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent...
CVE-2026-17593
An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permissi
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote...
CVE-2026-20337
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condi
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An...
CVE-2026-14644
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with
A user holding a permission to update privilege definitions could modify a wildcard privilege...
CVE-2026-17601
A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization...
CVE-2026-17594
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in th
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke...
CVE-2026-17600
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissio
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could...
CVE-2026-17603
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the Data
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
CVE-2026-67422
### Summary Four inline processors in pymdown-extensions contain regular expressions with exponential backtracking. A s
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
CVE-2026-63222
### Impact In affected versions, calling `UploadedFile::move()` **without a second argument** uses the client-provided f
jsii-diff: Command Injection via npm: package argument
CVE-2026-15895
## Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report erro
go-git: Worktree operations may follow symlinks
CVE-2026-71556
## Impact A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended wo
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
## Summary The `check_unsafe_options` guard can be bypassed on every guarded method (clone/clone_from, fetch/pull/push,
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
## Summary GitPython's config-name validator only neutralizes CR/LF/NUL for the `"option"` label; it does not reject `=`
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
### Summary GitPython computes the on-disk location of a submodule's separate Git directory (`.git/modules/`) from the s
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
## Summary `Repo.init()` forwards `**kwargs` verbatim to `git init` with no unsafe-option guard and no `allow_unsafe_opt
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
## Summary `IndexFile.from_tree`, `IndexFile.reset` (→ from_tree) and `IndexFile.merge_tree` append caller-influenced tr
A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is...
CVE-2026-19189
A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functional
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate...
CVE-2026-65668
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a netwo