Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
CVE-2026-46611
### Summary The Glances XML-RPC server (`glances -s`, implemented in `glances/server.py`) does not validate the HTTP `H
#severity:medium
共收录 5559 条相关情报。
← 返回所有主题Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default...
CVE-2026-44273
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high
IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSphere Application...
CVE-2026-10852
IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSphere Application Server Liberty are vulnera
Paymenter has broken object level authorization via service reference manipulation on ticket creation
CVE-2026-44585
### Summary The ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validati
Paymenter doesn't reset email verification status after email change
CVE-2026-44584
### Summary The email update functionality fails to invalidate the existing verification state when a user changes their
Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module
CVE-2026-44583
### Summary The PayPal webhook endpoint `/extensions/paypal/webhook` processes the `PAYPAL-CERT-URL` HTTP header without
Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
CVE-2026-44517
### Impact When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository o
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
CVE-2026-44202
OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock O
runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
CVE-2026-41579
### Impact When setting up the container rootfs, `setupPtmx` and `setupDevSymlinks` call `os.Remove` and `os.Symlink` wi
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
CVE-2026-33731
## Summary The Authorize.Net webhook handler at `plugin/AuthorizeNet/webhook.php` contains a signature verification byp
Akaunting 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the...
CVE-2026-11994
Akaunting 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow.
IBM Watson Speech Services Cartridge is vulnerable to Server-Side Request Forgery (SSRF) in...
CVE-2026-7253
IBM Watson Speech Services Cartridge is vulnerable to Server-Side Request Forgery (SSRF) in Sterling File Gateway, due t
A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine...
CVE-2026-8934
A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud C
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an...
CVE-2026-8636
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve use
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0...
CVE-2026-9320
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 a
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is...
CVE-2026-8059
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site script
Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3...
CVE-2026-41047
Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacke
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are...
CVE-2026-12725
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of
The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific...
CVE-2026-12549
The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a gene
A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the ...
CVE-2026-12479
A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method