共收录 5559 条相关情报。
← 返回所有主题CVE-2026-49336
### Summary `@microsoft/kiota-http-fetchlibrary`'s `RedirectHandler` is documented as stripping `Authorization` and `Co
CVE-2026-49288
### Impact An authenticated Control Panel user could view metadata and content for resources they don't have permission
CVE-2026-49359
### Summary `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` whe
CVE-2026-47072
### Summary CRLF injection in hackney's WebSocket upgrade request builder (`src/hackney_ws.erl`). `init/1` copies the `
CVE-2026-47075
### Summary `hackney_url:make_url/3` passes the URL query component directly into the HTTP/1.1 request target without p
CVE-2026-47070
### Summary The HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`,
CVE-2026-47076
### Summary `hackney_url:normalize/2` URL-decodes the host component of a parsed URL, but the caller's SSRF allowlist r
CVE-2026-48995
### Summary A malicious `codeload.github.com` server can serve whatever tarball it wants and pnpm will install it regar
CVE-2026-5223
The Rust Security Response Team was notified that Cargo incorrectly handled symlinks inside of crate tarballs downloaded
CVE-2024-23581
The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized
CVE-2026-50744
A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login me
CVE-2026-50740
A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and ea
CVE-2026-50739
A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation o
CVE-2026-50742
A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revi
CVE-2026-48934
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af
CVE-2026-50745
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script w
CVE-2026-8661
Server-Side Cross-Site Scripting and Server-Side Request Forgery vulnerability in the markdown_to_pdf action of Rapid7 I
CVE-2026-48619
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out
CVE-2026-13226
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection
CVE-2026-48615
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When