sigstore-go fails to check signature timestamps against a signing key's validity period
CVE-2026-54787
sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys
#severity:low
共收录 1585 条相关情报。
← 返回所有主题@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
CVE-2026-53607
### Summary When `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive...
CVE-2026-56570
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Va
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages...
CVE-2026-56568
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It inv
HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory,...
CVE-2026-56571
HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions
ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal
### Summary Active Record Tenanted's override of Active Storage's `DiskService#path_for` does not validate that the res
Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
CVE-2026-52838
## Summary Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking s
Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync
CVE-2026-52841
### Summary `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the se
Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass
CVE-2026-52839
## Summary Easy!Appointments correctly filters provider-scoped appointments in the `appointments/search` response, pro
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
CVE-2026-52840
### Summary `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to
@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate
### Summary A missing human-approval gate on the `create_dynatrace_notebook` tool allows a caller to create persistent t
datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
CVE-2026-55403
### Summary When `datamodel-code-generator` fetches a remote schema and follows an HTTP redirect, it re-sends the origi
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
CVE-2026-50568
`SanitizeFilePath` in `pkg/utils/utils.go` validated that a path stayed under a safe directory by calling `strings.HasPr
A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function...
CVE-2026-17458
A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file s
A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the...
CVE-2026-17459
A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.exter
A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the...
CVE-2026-17457
A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserN
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function...
CVE-2026-17434
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/mod
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function...
CVE-2026-17433
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of t
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this...
CVE-2026-17432
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functio
Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics
## Summary `hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server