Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated...

CVE-2026-3828

Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command executi

历史摘要 · 未重新核验 · GitHub Advisory

Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in...

CVE-2026-8208

Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the re

历史摘要 · 未重新核验 · GitHub Advisory

Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by...

CVE-2026-8207

Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/gr

历史摘要 · 未重新核验 · GitHub Advisory

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression...

CVE-2026-41705

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized

历史摘要 · 未重新核验 · GitHub Advisory

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary...

CVE-2026-6664

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to

历史摘要 · 未重新核验 · GitHub Advisory

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly...

CVE-2026-6665

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the conten

历史摘要 · 未重新核验 · GitHub Advisory

Velocity.js has a Prototype Pollution vulnerability through #set path assignment

CVE-2026-44966

### Summary A prototype pollution vulnerability was discovered in Velocity.js )[key] = val`. Because there is no valid

历史摘要 · 未重新核验 · GitHub Advisory

@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

CVE-2026-44895

## SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations

历史摘要 · 未重新核验 · GitHub Advisory

smallbitvec: Integer overflow in safe API leads to heap buffer overflow

CVE-2026-44983

### Summary An integer overflow in the internal capacity calculation of `smallbitvec` can lead to an undersized heap all

历史摘要 · 未重新核验 · GitHub Advisory

epa4all-client has a VAU Signature bypass

CVE-2026-44900

### Impact In SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the b

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

Summary The patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value().

历史摘要 · 未重新核验 · GitHub Advisory

LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists

CVE-2026-44843

LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled pa

历史摘要 · 未重新核验 · GitHub Advisory

Phpseclib needs guardrails on large binaryfield integers

CVE-2023-49316

### Impact Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc) ### Patch

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating

CVE-2026-44328

### Summary free5GC's SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as

历史摘要 · 未重新核验 · GitHub Advisory

free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types

CVE-2026-44325

### Summary free5GC's NRF root SBI endpoint `POST /oauth2/token` contains a parser-level type-confusion bug family. The

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference

CVE-2026-44322

### Summary free5GC's NEF `PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId}` handler pan

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)

CVE-2026-44321

### Summary free5GC's SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path

CVE-2026-44320

### Summary free5GC's NEF mounts the `nnef-callback` route group without inbound OAuth2/bearer-token authorization. A fo

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

CVE-2026-44319

### Summary free5GC's NEF terminates the entire process when a stored PFD-subscription `notifyUri` cannot be reached. In

历史摘要 · 未重新核验 · GitHub Advisory

free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference

CVE-2026-44316

### Summary free5GC's PCF `POST /npcf-smpolicycontrol/v1/sm-policies` handler (`HandleCreateSmPolicyRequest`) panics wit

历史摘要 · 未重新核验 · GitHub Advisory