Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft...
CVE-2026-57977
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)
#severity:high
共收录 5441 条相关情报。
← 返回所有主题A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to...
CVE-2026-12481
A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deser
A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the...
CVE-2026-14605
A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the function recvmsg in the l
A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow...
CVE-2026-58379
A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a rem
A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the...
CVE-2026-14606
A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CAN_Receive in the
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...
CVE-2026-53478
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...
CVE-2026-49814
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...
CVE-2026-49815
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r
Improper neutralization of argument delimiters in a command ('argument injection') vulnerability...
CVE-2026-14459
Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Softw
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute...
CVE-2026-14460
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Ar
Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
CVE-2026-49360
### Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulner
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
CVE-2026-49353
## Summary The fix for CVE-2026-46339 (unauthenticated RCE via unprotected MCP plugin routes) introduced a local-only a
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
CVE-2026-46599
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit
SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`
CVE-2026-49284
## Summary SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login. If a saved SP
Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename
CVE-2026-52792
### Summary Algernon selects its file handler from `filepath.Ext()` (engine/handlers.go:134), which does not treat the
jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow
CVE-2026-52834
### Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in l
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
CVE-2026-2092
Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not si
Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
CVE-2026-50200
### Summary The `Sanitizer` component in the Environment actuator redacts configuration values by matching the configur
Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
CVE-2026-50196
### Summary `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
CVE-2026-50194
### Summary When Steeltoe management endpoints are configured to listen on an alternate port (`Management:Endpoints:Por