safeurl is Missing IPv6 CIDR Ranges in Blocklist
CVE-2026-54452
The `privateNetworks` blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR r
#severity:medium
共收录 5559 条相关情报。
← 返回所有主题FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
CVE-2026-53656
### Impact The FiftyOne App/API server (`fiftyone/server/app.py`) and the `/media` route (`fiftyone/server/routes/media
CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to...
CVE-2026-55398
CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with
CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14...
CVE-2026-55399
CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with vali
CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55....
CVE-2026-33444
CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate kno
CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients...
CVE-2026-40953
CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers
o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page...
CVE-2026-40957
o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them...
CVE-2026-26032
The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
CVE-2026-52883
Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. Th
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
CVE-2026-52882
### Impact Users below _report_issues_for_unreleased_versions_threshold_ can assign unreleased product versions. ### Pa
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform...
CVE-2026-20298
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.26
Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly...
CVE-2026-14961
Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sen
Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure...
CVE-2026-56087
Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability. An attacker with ph
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector ...
CVE-2026-20146
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting ...
CVE-2026-1563
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a u
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS)...
CVE-2026-1562
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user
Improper neutralization of input during web page generation ('cross-site scripting')...
CVE-2026-9007
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
CVE-2026-54494
## Summary Koel's outbound-URL guard `App\Helpers\Network::isPublicHost()` classifies an IP as "public" using PHP's `fi
Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
CVE-2026-50552
Summary Koel v9.5.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint
Koel has SSRF through Authenticated Subsonic podcast feed URLs
## Summary Koel's Subsonic `createPodcastChannel.view` endpoint accepts a user supplied podcast feed URL and fetches it