Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used...

CVE-2026-48448

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL

历史摘要 · 未重新核验 · GitHub Advisory

A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability...

CVE-2026-18187

A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-control

历史摘要 · 未重新核验 · GitHub Advisory

A format string vulnerability was found in the Notification OAuth settings of ADM. The...

CVE-2026-67244

A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user

历史摘要 · 未重新核验 · GitHub Advisory

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability...

CVE-2026-18186

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-contr

历史摘要 · 未重新核验 · GitHub Advisory

netfoil: Incorrect block responses could lead to localhost traffic

### Summary `0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfo

历史摘要 · 未重新核验 · GitHub Advisory

ZITADEL Users Can Self-Verify Email/Phone via API

CVE-2026-54693

### Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as veri

历史摘要 · 未重新核验 · GitHub Advisory

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

CVE-2026-54727

## Affected Component - **Package:** proot-distro - **Affected command:** `restore` - **Attack surface:** Host-side Ter

历史摘要 · 未重新核验 · GitHub Advisory

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

CVE-2026-54574

**Repository:** `termux/proot-distro` **Component:** `proot_distro/commands/install.py` → `_extract_plain_tar()`; also

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

CVE-2026-55651

### Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to ob

历史摘要 · 未重新核验 · GitHub Advisory

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

CVE-2026-11393

### Summary The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon

历史摘要 · 未重新核验 · GitHub Advisory

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

CVE-2026-50559

Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parame

历史摘要 · 未重新核验 · GitHub Advisory

Req vulnerable to unbounded archive/compression extraction triggered by response content-type

CVE-2026-49755

### Summary Req's default response pipeline auto-decodes archive and compressed bodies based on the server-supplied `co

历史摘要 · 未重新核验 · GitHub Advisory

veraPDF Validation XXE via Rich Text

CVE-2026-54078

## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote atta

历史摘要 · 未重新核验 · GitHub Advisory

veraPDF Validation XXE via XFA

CVE-2026-54079

## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote atta

历史摘要 · 未重新核验 · GitHub Advisory

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

CVE-2026-54666

### Summary `swagger-typescript-api` interpolates OpenAPI path strings (the keys of the `paths` object, e.g. `/users/{i

历史摘要 · 未重新核验 · GitHub Advisory

swagger-typescript-api vulnerable to code injection via unescaped enum string values

CVE-2026-54664

### Summary `swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generat

历史摘要 · 未重新核验 · GitHub Advisory

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all...

CVE-2026-12144

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl

历史摘要 · 未重新核验 · GitHub Advisory

Style Dictionary - Prototype Pollution in convertTokenData utility function

CVE-2026-54639

### Impact Prototype pollution. A malicious user can create a token array `[{ key: '{__proto__.foo}', value: 'malicious'

历史摘要 · 未重新核验 · GitHub Advisory

openhole-server vulnerable to path traversal via URL-decoded request path

CVE-2026-54650

## Summary openhole-server forwarded the URL-decoded request path (`r.URL.Path`) to tunnel clients instead of the origi

历史摘要 · 未重新核验 · GitHub Advisory

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

CVE-2026-54638

### Impact A remote, unauthenticated attacker can cause excessive memory allocation (and resulting CPU / GC pressure, p

历史摘要 · 未重新核验 · GitHub Advisory