A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins...
CVE-2026-53702
A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buf
#severity:medium
共收录 5584 条相关情报。
← 返回所有主题An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition...
CVE-2026-53701
An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad.
An authorization issue was addressed with improved state management. This issue is fixed in iOS...
CVE-2025-46308
An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, ma
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS...
CVE-2025-43339
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. A malicious
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia...
CVE-2025-46293
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be ab
A parsing issue in the handling of directory paths was addressed with improved path validation....
CVE-2025-24268
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in m
A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS...
CVE-2025-30459
A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4. An app may be
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS...
CVE-2025-30431
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Vent
Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input
CVE-2026-48108
### Summary `russh` did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the
Russh: Unchecked keyboard-interactive prompt count in client auth path
CVE-2026-48107
### Summary In the `russh` client keyboard-interactive authentication path, a malicious SSH server could send a `USERAUT
OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning
CVE-2026-48096
### Description In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
CVE-2026-48067
The `recordSelectOptionsQuery()` method may be used to scope the options available in the `Select` field for `AttachActi
IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be...
CVE-2024-45636
IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileg
IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request...
CVE-2026-3341
IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allo
IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper...
CVE-2026-4096
IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by th
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by...
CVE-2026-11945
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON docume
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended...
CVE-2026-11986
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabi
Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
CVE-2026-48053
## Summary Several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs f
@hapi/inert has a static-file confinement bypass via sibling-prefix path
CVE-2026-48049
### Impact `@hapi/inert` serves static files from a directory configured with `path` (in the `directory` / `file` handle
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4,...
CVE-2026-6338
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13