Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth...
CVE-2026-8197
Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template render
#severity:high
共收录 5513 条相关情报。
← 返回所有主题LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update...
CVE-2026-47102
LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint c
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to ...
CVE-2026-8140
Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/down
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to...
CVE-2026-47101
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role
IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote...
CVE-2026-47114
IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbit
Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated...
CVE-2026-46473
Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated using Perl's built-in r
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
CVE-2026-46625
## Summary `js-cookie`'s internal `assign()` helper copies properties with `for...in` + plain assignment. When the sour
Russh: Unchecked CryptoVec allocation and growth handling is reachable
CVE-2026-46673
### Title Unchecked `CryptoVec` allocation and growth handling was reachable from local agent inputs in current `russh`
@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails
Impact: @hulumi/policies versions before 1.3.2 used stack-wide evidence shortcuts in several Cloudflare and deployment-g
@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the adm
@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass
Impact: @hulumi/policies versions before 1.3.2 could accept spoofed SecureBucket parent evidence for HULUMI-H1, allowing
@hulumi/drift: Orphan reconciler accepted externally supplied execute plans
Impact: @hulumi/drift versions before 1.3.2 could accept externally supplied execute plans without sufficient provenance
MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
CVE-2026-46519
## Summary `mcp-server-kubernetes` exposes three environment variables (`ALLOW_ONLY_READONLY_TOOLS`, `ALLOW_ONLY_NON_DE
Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
CVE-2026-46654
### Impact - **Key**: `challenger/src/multi_field_challenger.rs` | `MultiField32Challenger::duplexing` | `transcript_ma
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting...
CVE-2026-9144
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedde
Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0...
CVE-2026-9123
Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local
A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action...
CVE-2026-9136
A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlle
A potential security vulnerability has been identified in the HP Linux Imaging and Printing...
CVE-2026-8632
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vul
Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to...
CVE-2026-9120
Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code vi
Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker...
CVE-2026-9121
Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit h