A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-fo...

CVE-2026-120190

A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functio

来源摘录 · NVD / GitHub Advisory

Forge: ASN.1 OID first arc truncation in asn1.oidToDer

CVE-2026-118775

### Summary `asn1.oidToDer()` did not range-check the first two arcs of an OID string, so an OID such as `0.42.840.1135

来源摘录 · GitHub Advisory

Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

CVE-2026-118781

### Summary `BigInteger.prototype.modInverse()` in node-forge's bundled jsbn library enters an infinite loop when the v

来源摘录 · GitHub Advisory

Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

CVE-2026-118780

### Summary When a CA store created by `pki.createCaStore()` holds two or more certificates with the same subject name,

来源摘录 · GitHub Advisory

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

CVE-2026-116775

## Summary `pageant::PageantStream` reads a 4-byte big-endian length prefix from its input stream and buffers until `le

来源摘录 · GitHub Advisory

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

CVE-2026-116696

### Summary **All evidence, reproduction steps, and scripts in the report were verified against a real running instance

来源摘录 · GitHub Advisory

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting i...

CVE-2026-116251

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own chang

来源摘录 · NVD / GitHub Advisory

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recove...

CVE-2026-119280

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3

来源摘录 · NVD / GitHub Advisory

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInv...

CVE-2026-118781

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(...

CVE-2026-118780

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first...

CVE-2026-118775

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn

来源摘录 · NVD / GitHub Advisory

Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence

Cedar users must be using all of the following features to be affected by this advisory: JSON format policies, policy te

来源摘录 · GitHub Advisory

Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

CVE-2026-61448

### Impact Parse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a

来源摘录 · GitHub Advisory

PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

### Summary During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious

来源摘录 · GitHub Advisory

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that ...

CVE-2026-93571

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update req

来源摘录 · NVD / GitHub Advisory

A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unk...

CVE-2026-118585

A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad

来源摘录 · NVD / GitHub Advisory

A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipula...

CVE-2026-118578

A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown

来源摘录 · NVD / GitHub Advisory

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to ser...

CVE-2026-118577

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the c

来源摘录 · NVD / GitHub Advisory

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

CVE-2026-116578

### Summary `tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a templa

来源摘录 · GitHub Advisory

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the...

CVE-2026-118273

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of

历史摘要 · 未重新核验 · GitHub Advisory