Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

CVE-2026-45298

## Summary In a default dozzle deploy (the documented quickstart, no `DOZZLE_AUTH_PROVIDER` set), `POST /api/notificati

历史摘要 · 未重新核验 · GitHub Advisory

shopper/framework: Authorization bypass in multiple Livewire admin components

## Impact Multiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data wi

历史摘要 · 未重新核验 · GitHub Advisory

iskorotkov/avro: CPU Exhaustion in Decoder

CVE-2026-46385

# CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration ## Summary The Avro array and map decoders looped

历史摘要 · 未重新核验 · GitHub Advisory

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

CVE-2026-45270

## Summary The `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but pe

历史摘要 · 未重新核验 · GitHub Advisory

iskorotkov/avro: Integer Overflow in Decoder

CVE-2026-46384

# Integer Overflow in Avro Decoder ## Summary Several Avro decoder paths read attacker-controlled 64-bit values from t

历史摘要 · 未重新核验 · GitHub Advisory

eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges

### Impact In eduMFA = 2.9.1 by adding validity information to the userless challenges. ### Workarounds No known workar

历史摘要 · 未重新核验 · GitHub Advisory

eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage

### Impact For deployments using MySQL or MariaDB = 11.6.2 the default is ON, which is not affected - Same rules applie

历史摘要 · 未重新核验 · GitHub Advisory

form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys

CVE-2026-46510

## Summary `form-data-objectizer` walks bracket-notation form keys (e.g. `name[sub]`) into nested objects without filte

历史摘要 · 未重新核验 · GitHub Advisory

Graphite Has a Pickle Deserialization Vulnerability

### Impact **Type of vulnerability:** Insecure Deserialization via Python's `pickle` module. **Who is impacted:** Use

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree

CVE-2026-45539

## Summary Two primitive integrators in `apm-cli` enumerate package files with bare `Path.glob()` / `Path.rglob()` call

历史摘要 · 未重新核验 · GitHub Advisory

iskorotkov/avro: Denial-of-Service Vulnerability in Decoder

# Memory Exhaustion via Unbounded Map Allocations in Avro Decoder ## Summary The Avro map decoder accepted attacker-co

历史摘要 · 未重新核验 · GitHub Advisory

Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and...

CVE-2026-0983

Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 all

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of input during web page generation ('cross-site scripting')...

CVE-2026-7498

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Informatio

历史摘要 · 未重新核验 · GitHub Advisory

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize...

CVE-2026-6346

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fie

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability in Command-Line Client in P4 Server prior to the 2025.2 Patch 2, identified as...

CVE-2026-6902

A vulnerability in Command-Line Client in P4 Server prior to the 2025.2 Patch 2, identified as CVE-2026-6902, has been f

历史摘要 · 未重新核验 · GitHub Advisory

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize...

CVE-2026-6347

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fie

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function...

CVE-2026-8776

A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the fi

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the...

CVE-2026-8775

A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetu

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the...

CVE-2026-8764

A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of t

历史摘要 · 未重新核验 · GitHub Advisory

Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows...

CVE-2018-25338

Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extr

历史摘要 · 未重新核验 · GitHub Advisory