Filament: Unauthenticated temporary file upload on auth pages

CVE-2026-48500

Any schema can contain a file upload form field, so Filament applies Livewire's `WithFileUploads` trait to the Livewire

历史摘要 · 未重新核验 · GitHub Advisory

opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

CVE-2026-48496

### Summary An unprivileged process can easily trigger the `processPIDEvents` goroutine to be blocked indefinitely, pre

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

CVE-2026-48493

### Impact A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant th

历史摘要 · 未重新核验 · GitHub Advisory

Snipe-IT's selectlist visibility is too permissive

CVE-2026-48492

### Impact The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into

历史摘要 · 未重新核验 · GitHub Advisory

OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation

CVE-2026-48480

The codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final ch

历史摘要 · 未重新核验 · GitHub Advisory

Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

CVE-2026-48167

The `ImageColumn` and `ImageEntry` components render raw database values without escaping HTML. Where the data passed to

历史摘要 · 未重新核验 · GitHub Advisory

Filament: Timing-based user enumeration on login page

CVE-2026-48166

The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email

历史摘要 · 未重新核验 · GitHub Advisory

Slim has Reflected XSS in the HtmlErrorRenderer

CVE-2026-48157

### Impact If an application uses `HttpException::setTitle()` and/or `setDescription()` to include untrusted/request-de

历史摘要 · 未重新核验 · GitHub Advisory

jackson-databind has @JsonView bypass for setterless creator properties

CVE-2026-54517

## Summary In `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only t

历史摘要 · 未重新核验 · GitHub Advisory

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

CVE-2026-54516

## Summary `POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty("renamed")` on the getter

历史摘要 · 未重新核验 · GitHub Advisory

jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

CVE-2026-54515

## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by

历史摘要 · 未重新核验 · GitHub Advisory

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in...

CVE-2026-56698

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open optio

历史摘要 · 未重新核验 · GitHub Advisory

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as /...

CVE-2026-56697

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNu

历史摘要 · 未重新核验 · GitHub Advisory

@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields

CVE-2026-50179

## Summary `exportToCSV` and `exportQueryToCSV` in `packages/loot-core/src/server/transactions/export/export-to-csv.ts`

历史摘要 · 未重新核验 · GitHub Advisory

zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet

CVE-2026-48487

### Impact `_read_character_string` and `_read_string` in `src/zeroconf/_protocol/incoming.py` sliced `self.data[self.o

历史摘要 · 未重新核验 · GitHub Advisory

devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs

### Summary The default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into

历史摘要 · 未重新核验 · GitHub Advisory

nebula-mesh's stores enrollment tokens unhashed in SQLite

`internal/store/sqlite.go:1177,1192,1221,1245` — the `enrollment_tokens.token` column holds the raw UUID token. `Consume

历史摘要 · 未重新核验 · GitHub Advisory

Gogs has SSRF in webhook deliveries

CVE-2026-47267

### Summary The fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolv

历史摘要 · 未重新核验 · GitHub Advisory

@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

CVE-2026-46700

## Summary In `@actual-app/sync-server`, the `GET /secret/:name` endpoint (`app-secrets.js:53`) checks only that the ca

历史摘要 · 未重新核验 · GitHub Advisory

@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper

CVE-2026-46672

## Summary `@actual-app/cli` ships a hand-rolled CSV serializer in `packages/cli/src/output.ts` (used whenever the glob

历史摘要 · 未重新核验 · GitHub Advisory