kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
CVE-2026-100351
## Summary `openapi3filter.ValidationHandler.Middleware` validates requests with kin-openapi's legacy router, which sel
#severity:high
共收录 5417 条相关情报。
← 返回所有主题Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
CVE-2026-103030
### Summary `dio_http2_adapter` follows HTTP `Location` redirects without stripping sensitive request headers when the
mise permits untrusted local configuration to override default shell arguments
CVE-2026-103929
## Summary Untrusted local .mise.toml [settings] can set the shell interpreter args (unix/windows default_inline / defa
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a...
CVE-2026-110907
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string
A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an...
CVE-2026-76659
A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to c
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.
CVE-2026-76660
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS...
CVE-2026-110908
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulner
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to...
CVE-2026-77931
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS comman
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption...
CVE-2026-76663
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor...
CVE-2026-76066
IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against t
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
CVE-2026-76661
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption
CVE-2026-73799
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that...
CVE-2026-0993
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated re
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection...
CVE-2026-109430
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass...
CVE-2026-110863
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows au
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser...
CVE-2026-110871
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allow
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared...
CVE-2026-110873
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwr
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection...
CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUT
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to...
CVE-2026-110868
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP c
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users...
CVE-2026-110865
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHead