A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown...
CVE-2026-18646
A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system
#severity:medium
共收录 5494 条相关情报。
← 返回所有主题Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does...
CVE-2026-68979
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization
The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows...
CVE-2026-58139
The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with S
A race condition exists in the cloud-based Omada device adoption process when an attacker may be...
CVE-2025-15630
A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with t
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up...
CVE-2026-18641
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by
A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper...
CVE-2026-38446
A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread e
A cryptographic weakness exists in affected Omada devices where site credentials are protected...
CVE-2025-15631
A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing al
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header...
CVE-2026-38444
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is
A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard...
CVE-2025-15627
A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to
A cryptographic weakness exists in the Omada device adoption process. During adoption,...
CVE-2025-15544
A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials assoc
A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used...
CVE-2025-15629
A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communicati
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
CVE-2026-69248
### Summary If an intermediate constrained CA permits the DNS name `foo.example.com`, and the leaf certificate has a wil
Guzzle: Noncanonical cookie domain keeps subdomain scope
CVE-2026-69245
### Impact `SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the
AIOHTTP: HTTP request smuggling via WebSocket upgrade
CVE-2026-69243
### Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. ### Impact
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
CVE-2026-59881
### Summary The client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extensi
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
CVE-2026-69207
### Summary The built-in CORS middleware (`hono/cors`) parses the attacker-controlled `Access-Control-Request-Headers`
GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count
## Summary `Commit.count()` forwards `**kwargs` into `rev_list` with **no** `check_unsafe_options` guard (the guard exis
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
**Target:** gitpython-developers/GitPython **Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
CVE-2026-69198
### Summary Every special-use classification method is built on `isInSubnet`, which short-circuits to `false` whenever
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
CVE-2026-54272
### Summary `Address6`'s special-property checks misclassify IPv4-mapped (`::ffff:0:0/96`) and NAT64 well-known (`64:ff