Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite ...

CVE-2026-62480

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations)

历史摘要 · 未重新核验 · GitHub Advisory

Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

## Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configu

历史摘要 · 未重新核验 · GitHub Advisory

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

## Summary A WebSocket upgrade request to an `upgradeWebSocket` route with a missing or malformed `Sec-WebSocket-Key` h

历史摘要 · 未重新核验 · GitHub Advisory

Loofah: SVG `href` attribute bypasses local-reference restriction

## Summary Loofah's HTML5 sanitizer restricted only the `xlink:href` attribute on certain SVG elements to local, same-d

历史摘要 · 未重新核验 · GitHub Advisory

jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

CVE-2026-59889

## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by it

历史摘要 · 未重新核验 · GitHub Advisory

TypeORM: migration:generate template-literal code injection

### Summary `typeorm migration:generate` embeds database schema metadata into JS/TS template literals, escaping backtic

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

CVE-2026-58429

### Summary A personal access token restricted with the public-only scope can still retrieve private organization member

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

CVE-2026-59765

### Summary Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, w

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

CVE-2026-57897

**Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

CVE-2026-58510

## Summary GHSA-8fwc-qjw5-rvgp ("Gitea may send release notification emails for private repositories to users whose acc

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Public-only API token restriction is not enforced on team API routes

CVE-2026-58431

### Summary Gitea's `/api/v1/teams/{id}` API routes do not correctly enforce the `public-only` access token restriction

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

CVE-2026-58427

## Summary PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enum

历史摘要 · 未重新核验 · GitHub Advisory

Gitea SSH Key Parser Denial of Service

CVE-2026-56657

Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 (SSH2) format and normalises them before storage. The normal

历史摘要 · 未重新核验 · GitHub Advisory

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers...

CVE-2026-63729

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince co

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown...

CVE-2026-16331

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/fu

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the...

CVE-2026-16332

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_upload

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the...

CVE-2026-16329

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/up

历史摘要 · 未重新核验 · GitHub Advisory

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown...

CVE-2026-16330

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jqu

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown...

CVE-2026-16327

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_

历史摘要 · 未重新核验 · GitHub Advisory

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery...

CVE-2026-64626

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the en

历史摘要 · 未重新核验 · GitHub Advisory