ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation

## Summary The SSH protocol parser trusted attacker-controlled length and count fields without first checking that the

历史摘要 · 未重新核验 · GitHub Advisory

Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

CVE-2026-46371

### Summary A vulnerability in Fleet's Apple MDM commands listing endpoint allowed authenticated users with the lowest-

历史摘要 · 未重新核验 · GitHub Advisory

Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

CVE-2026-46370

### Summary A vulnerability in Fleet's labels host-listing endpoint allowed authenticated users with the lowest-privile

历史摘要 · 未重新核验 · GitHub Advisory

Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

CVE-2026-44311

### Summary A potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-c

历史摘要 · 未重新核验 · GitHub Advisory

PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures

`PyCFunction::new_closure` (and the temporary `new_closure_bound` complement in the 0.21–0.22 series) required the suppl

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 CMS has Broken Access Control in the Recycler Module

CVE-2026-47349

### Problem Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for t

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities

CVE-2026-47347

### Problem Applications that use `GeneralUtility::sanitizeLocalUrl` to allow only local URLs are vulnerable to open red

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 HTML Sanitizer allows Cross-site Scripting

CVE-2026-47345

Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 CMS has Broken Access Control in its DataHandler

CVE-2026-47350

### Problem Backend users were able to move records to a different page without having edit permissions on the source pa

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 CMS has Insecure Deserialization via Core API

CVE-2026-49740

### Problem TYPO3's cache frontend (`VariableFrontend`) and persistent key-value store (`Registry`) deserialized PHP pay

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 CMS has Broken Access Control in Backend API

CVE-2026-47352

### Problem Authenticated backend users were able to retrieve file metadata via several Backend API routes without prope

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 CMS: Broken Access Control in Media Module

CVE-2026-47351

### Problem Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read p

历史摘要 · 未重新核验 · GitHub Advisory

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ...

CVE-2026-9125

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the

历史摘要 · 未重新核验 · GitHub Advisory

Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote...

CVE-2026-12033

Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromise

历史摘要 · 未重新核验 · GitHub Advisory

Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115...

CVE-2026-12025

Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allowed a remote attacker

历史摘要 · 未重新核验 · GitHub Advisory

Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who...

CVE-2026-12015

Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the re

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop...

CVE-2026-53808

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows a

历史摘要 · 未重新核验 · GitHub Advisory

Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows...

CVE-2026-53782

Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast

历史摘要 · 未重新核验 · GitHub Advisory

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network...

CVE-2026-49949

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercep

历史摘要 · 未重新核验 · GitHub Advisory

Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers...

CVE-2026-53781

Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhausti

历史摘要 · 未重新核验 · GitHub Advisory