Grav API Privilege Escalation to Super Admin
CVE-2026-42843
### Summary An insecure direct object reference and logic flaw in the Grav API plugin (`UsersController::update`) allow
#severity:high
共收录 5513 条相关情报。
← 返回所有主题PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
CVE-2026-42315
### Summary No sanitization of package folder name allows writing files anywhere outside the intended download directory
phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
CVE-2026-44167
### Impact Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc) ### Patch
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
CVE-2026-43891
### Details The vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
## Summary The validator-mode sandbox executor (`src/gep/validator/sandboxExecutor.js`) places `npm` and `npx` in its h
@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)
## Summary The `evolver fetch` subcommand in `index.js` writes Hub-supplied `bundled_files[]` into a directory derived
Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled
### Summary A specially constructed quic package can crash the server OOM when the sniff is enabled. ### Details When
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
CVE-2026-42304
### Details The twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during D
GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
CVE-2026-42285
### Summary Remote Denial of Service (DoS) via Nil Pointer Dereference in BGP Update Processing An unauthenticated remot
JupyterHub has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
CVE-2026-42266
The allow-list of extensions that can be installed from PyPI Extension Manager (`allowed_extensions_uris`) is not correc
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
CVE-2026-42260
### Summary `src/utils/urlSafety.ts` exposes `isPublicHttpUrl` / `assertPublicHttpUrl`, used to gate the MCP `fetchWebCo
YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers
CVE-2026-43939
**Description:** Stored Cross-Site Scripting (XSS) occurs when user-supplied input is persisted by the application and l
YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`
CVE-2026-43937
**Issue Details:** YAFNET's only admin authorization gate is `PageSecurityCheckAttribute`, implemented as a `ResultFilte
YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header
CVE-2026-43938
**Description:** Stored (second-order) Cross-Site Scripting (XSS) occurs when attacker-controlled input is persisted thr
ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs
CVE-2026-43929
### Summary `ssrfcheck` v1.3.0 (latest) fails to block Server-Side Request Forgery attacks when the target private IP a
ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid
CVE-2025-8267
# SSRF Bypass in `ssrfcheck` - fails to classify reserved IP address space as invalid `ssrfcheck` is an npm package tha
RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover
## Summary `ListServiceAccount` (`GET /rustfs/admin/v3/list-service-accounts?user=`) authorizes cross-user requests aga
link-preview-js vulnerable to IPv6 and internal loopback attacks
CVE-2026-43897
### Impact The library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be r
pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS
CVE-2026-42198
## Summary pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. ### Impact A ma
exiftool-vendored vulnerable to argument injection via newline characters in tag names
CVE-2026-43893
### Impact `exiftool-vendored` starts ExifTool in `-stay_open True -@ -` mode, where arguments are read from stdin one