IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly...

CVE-2025-36290

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate valid

历史摘要 · 未重新核验 · GitHub Advisory

MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

CVE-2026-55855

### Summary A SQL injection is possible when the connector escapes Buffer parameters client-side under a multi-byte cli

历史摘要 · 未重新核验 · GitHub Advisory

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

CVE-2026-55860

### Summary The connector does not gate clear-text password authentication plugins on transport encryption. A hostile o

历史摘要 · 未重新核验 · GitHub Advisory

org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

CVE-2026-55859

### Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A serv

历史摘要 · 未重新核验 · GitHub Advisory

org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

CVE-2026-55858

### Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A serv

历史摘要 · 未重新核验 · GitHub Advisory

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

CVE-2026-55857

### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in

历史摘要 · 未重新核验 · GitHub Advisory

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

CVE-2026-55856

### Summary When a Java application connects with sslMode=verify-full (or verify-ca) and a password but does not pin a

历史摘要 · 未重新核验 · GitHub Advisory

silverstripe/versioned has XSS in archive admin restore

CVE-2026-55779

### Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin ### Reporter Stev

历史摘要 · 未重新核验 · GitHub Advisory

SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets

CVE-2026-55873

### Summary SeaweedFS routes requests signed with SigV4 service `s3tables` to the S3Tables management API. Authorization

历史摘要 · 未重新核验 · GitHub Advisory

Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

CVE-2026-55867

### Impact Graylog contains an insecure direct object reference (IDOR) vulnerability in the token revocation endpoint.

历史摘要 · 未重新核验 · GitHub Advisory

MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

CVE-2026-55854

### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in

历史摘要 · 未重新核验 · GitHub Advisory

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail...

CVE-2026-82306

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfi

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image...

CVE-2026-82343

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not

历史摘要 · 未重新核验 · GitHub Advisory

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE...

CVE-2026-82290

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attac

历史摘要 · 未重新核验 · GitHub Advisory

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler...

CVE-2026-82276

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override exec

历史摘要 · 未重新核验 · GitHub Advisory

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset

CVE-2026-55678

## Summary Arc Enterprise clustering accepts cluster join requests without authentication when `cluster.enabled=true` b

历史摘要 · 未重新核验 · GitHub Advisory

PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

CVE-2026-55696

### Summary Stored cross-site scripting (XSS) in PrivateBin's attachment download link. An anonymous attacker can creat

历史摘要 · 未重新核验 · GitHub Advisory

AIIR verification and policy gates could report success without enforcing the control (fail-open)

### Summary Several of AIIR's verification and policy paths could return a success/"verified" result without actually en

历史摘要 · 未重新核验 · GitHub Advisory

A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5...

CVE-2026-9491

A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote au

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of input during web page generation ('cross-site scripting')...

CVE-2026-82123

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & L

历史摘要 · 未重新核验 · GitHub Advisory