ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that...

CVE-2026-67599

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attacke

历史摘要 · 未重新核验 · GitHub Advisory

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2...

CVE-2026-62354

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients wit

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s...

CVE-2026-18614

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the...

CVE-2026-18615

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the...

CVE-2026-18616

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of

历史摘要 · 未重新核验 · GitHub Advisory

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper...

CVE-2026-59912

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnera

历史摘要 · 未重新核验 · GitHub Advisory

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing...

CVE-2026-59913

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Criti

历史摘要 · 未重新核验 · GitHub Advisory

Affected Omada devices rely on embedded certificates that are shared across deployments to...

CVE-2025-15628

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between contr

历史摘要 · 未重新核验 · GitHub Advisory

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

CVE-2026-69249

### Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the pro

历史摘要 · 未重新核验 · GitHub Advisory

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

CVE-2026-69247

### Summary `pkcs7_decrypt_der`, `pkcs7_decrypt_pem`, and `pkcs7_decrypt_smime` reported the outcome of decrypting a `R

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Noncanonical host can bypass host-based checks

CVE-2026-69246

### Impact In affected versions, Guzzle gives a transport the request URI as text and supplies the `Host` header separa

历史摘要 · 未重新核验 · GitHub Advisory

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

CVE-2026-69244

### Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malfo

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

**Target:** gitpython-developers/GitPython **Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version

历史摘要 · 未重新核验 · GitHub Advisory

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

CVE-2026-69192

### Summary `Address4` accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL hos

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

CVE-2026-13697

### Summary Two issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`: 1. **Shared

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to host confusion via backslash authority introducer

CVE-2026-18446

### Impact `fast-uri` v4.1.1 and earlier require a literal `//` to recognize a URI authority, so a reference that uses

历史摘要 · 未重新核验 · GitHub Advisory

Socket.IO: Zero-attachment Memory Exhaustion

CVE-2026-69185

### Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and b

历史摘要 · 未重新核验 · GitHub Advisory

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

CVE-2026-69152

### Summary The `maxLength` mitigation added in `5.0.8` for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It boun

历史摘要 · 未重新核验 · GitHub Advisory

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

CVE-2026-69151

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pip

历史摘要 · 未重新核验 · GitHub Advisory

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

CVE-2026-69149

A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`'s DOM emulation dependency (`domino`) wh

历史摘要 · 未重新核验 · GitHub Advisory