redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser...
CVE-2026-93435
redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious
#severity:high
共收录 5373 条相关情报。
← 返回所有主题Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate...
CVE-2026-85917
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a netw
Improper neutralization of input during web page generation ('cross-site scripting') in Azure...
CVE-2026-83946
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthori
Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose...
CVE-2026-68791
Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network
Improper neutralization of special elements used in a command ('command injection') in Microsoft...
CVE-2026-78501
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a...
CVE-2026-76154
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin...
CVE-2026-15815
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plug
There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library...
CVE-2026-19477
There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux (uldaq). This
Grav CMS vulnerable to remote code execution via .zip file upload
CVE-2026-72819
### Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
CVE-2026-75837
## Summary The core Flex group blueprint `system/blueprints/user/group.yaml` (access field, lines 48-55) omits the `secu
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
CVE-2026-74907
**Verified against:** `getgrav/grav` devel branch, `GRAV_VERSION = "2.0.15"`, file `index.php ## Title Unauthenticated
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
CVE-2026-72695
# Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion ## Summary A path traversal vulnerab
CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP
CVE-2026-86003
### Summary CoreDNS accepted [RFC 2136](https://datatracker.ietf.org/doc/html/rfc2136) UPDATE messages over DoH, DoH3,
react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU
CVE-2026-84997
### Summary A malformed HTTP message using `Transfer-Encoding: chunked` can drive `React\Http\Io\ChunkedDecoder` into a
CoreDNS: Unauthenticated memory exhaustion in custom transports
CVE-2026-82399
### Summary CoreDNS parses attacker-controlled DNS section counts before validating them on DNS-over-HTTPS (DoH and DoH
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
CVE-2026-81876
### Summary A malformed Smart Health Card (SHC) JWT with `zip: "DEF"` and an empty or truncated DEFLATE payload causes `
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
CVE-2026-81875
### Summary `SHCParser` inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit
djust: A template binding inherits a context safety grant it never earned (XSS)
A context safety grant was inherited by a template **binding** that never earned it, so rebinding a name the view had ma
djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
Five independent defects in djust's template auto-escaping cause attacker-controlled input to be rendered as live markup
Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)
CVE-2026-81516
## Summary Steeltoe's Consul discovery client parses the `secure` metadata field on each registered service instance us