Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.

CVE-2026-42667

Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.

CVE-2026-42775

Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0...

CVE-2026-42668

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.

CVE-2026-45437

Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.

CVE-2026-45441

Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.

历史摘要 · 未重新核验 · GitHub Advisory

aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

CVE-2026-11417

### Summary AWS CDK (`aws-cdk-lib`) is an open-source framework for defining cloud infrastructure in code and provisioni

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length

CVE-2026-50011

### Summary RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count dec

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Wrapping plain trust manager silently disables hostname verification

CVE-2026-50010

SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X5

历史摘要 · 未重新核验 · GitHub Advisory

Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

CVE-2026-48748

### Summary A memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blo

历史摘要 · 未重新核验 · GitHub Advisory

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

CVE-2026-54283

### Summary `request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form d

历史摘要 · 未重新核验 · GitHub Advisory

Nest: Middleware Bypass on Fastify via Trailing Slash

CVE-2026-54281

### Impact An authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`,

历史摘要 · 未重新核验 · GitHub Advisory

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

CVE-2026-53539

### Summary When parsing `application/x-www-form-urlencoded` bodies, `QuerystringParser` located the field separator wi

历史摘要 · 未重新核验 · GitHub Advisory

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

CVE-2026-49853

## Summary When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the

历史摘要 · 未重新核验 · GitHub Advisory

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

CVE-2026-49855

Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decom

历史摘要 · 未重新核验 · GitHub Advisory

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

CVE-2026-48818

### Summary When serving static files on Windows, `StaticFiles` resolves the requested path with [`os.path.realpath`](h

历史摘要 · 未重新核验 · GitHub Advisory

protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

CVE-2026-54271

## Summary A previous fix for unsafe name handling in `pbjs` static / static-module code generation was incomplete. Aff

历史摘要 · 未重新核验 · GitHub Advisory

Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

CVE-2026-45591

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.

历史摘要 · 未重新核验 · GitHub Advisory

The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query...

CVE-2026-9848

The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in vers

历史摘要 · 未重新核验 · GitHub Advisory

A symlink following vulnerability was found in the ABRT post-create event handler scripts in...

CVE-2026-54230

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts wr

历史摘要 · 未重新核验 · GitHub Advisory