A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP...

CVE-2026-48863

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows...

CVE-2026-23538

A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establi

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual...

CVE-2026-3842

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond

历史摘要 · 未重新核验 · GitHub Advisory

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level...

CVE-2026-63175

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than in

历史摘要 · 未重新核验 · GitHub Advisory

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

CVE-2026-54504

### Summary `@andrea9293/mcp-documentation-server` v1.13.0 documents that a Web UI starts automatically on port `3080`.

历史摘要 · 未重新核验 · GitHub Advisory

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

CVE-2026-50289

### Summary On Linux, `systeminformation`'s `networkInterfaces()` is vulnerable to OS command injection through the Deb

历史摘要 · 未重新核验 · GitHub Advisory

Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

CVE-2026-50285

## Summary The HPKE V2 URL decode path in `pkg/hpke/url.go` decompresses attacker-controlled zstd data without any size

历史摘要 · 未重新核验 · GitHub Advisory

dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

CVE-2026-50276

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without

历史摘要 · 未重新核验 · GitHub Advisory

dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS

CVE-2026-50274

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without

历史摘要 · 未重新核验 · GitHub Advisory

dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

CVE-2026-50273

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without

历史摘要 · 未重新核验 · GitHub Advisory

dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

CVE-2026-50272

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without

历史摘要 · 未重新核验 · GitHub Advisory

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

CVE-2026-50271

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without

历史摘要 · 未重新核验 · GitHub Advisory

dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

CVE-2026-50270

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without

历史摘要 · 未重新核验 · GitHub Advisory

ViewComponent: around_render HTML-Safety Bypass

CVE-2026-54498

## Summary `ViewComponent::Base#around_render` can return HTML-unsafe strings that bypass the escaping behavior applied

历史摘要 · 未重新核验 · GitHub Advisory

django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization

## Remote Code Execution via `eval()` in Elasticsearch Result Deserialization ### Summary The Elasticsearch backend in

历史摘要 · 未重新核验 · GitHub Advisory

TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

CVE-2026-54457

### Impact The `/internal/object_storage` endpoint accepts a caller-supplied JSON `storage_path` parameter that dynamic

历史摘要 · 未重新核验 · GitHub Advisory

obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

### Summary The Local REST API's `/vault/{path}` endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path *

历史摘要 · 未重新核验 · GitHub Advisory

CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55....

CVE-2026-33445

CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate

历史摘要 · 未重新核验 · GitHub Advisory

CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers...

CVE-2026-33443

CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledg

历史摘要 · 未重新核验 · GitHub Advisory

CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows...

CVE-2026-40952

CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to

历史摘要 · 未重新核验 · GitHub Advisory