Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing...
CVE-2026-42500
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid
#severity:medium
共收录 5624 条相关情报。
← 返回所有主题Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery...
CVE-2026-48555
Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows rem
A stored cross-site scripting (XSS) vulnerability has been identified in the web management...
CVE-2026-34127
A stored cross-site scripting (XSS) vulnerability has been identified in the web management interface of TP-Link's TL-SG
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
CVE-2026-49376
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
CVE-2026-49379
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
CVE-2026-49377
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of...
CVE-2026-49386
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in...
CVE-2026-49382
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
CVE-2026-49384
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to...
CVE-2026-49385
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service account
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
CVE-2026-49378
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository...
CVE-2026-49375
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups...
CVE-2026-49369
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder ...
CVE-2026-42951
An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes accoun
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits...
CVE-2026-44611
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is su
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can...
CVE-2026-40425
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive file
zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
CVE-2026-47184
### Impact `DNSCache._async_add` inserted every response record into `cache`, `_expirations`, `_expire_heap`, and `serv
zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
CVE-2026-47183
### Impact `DNSIncoming._log_exception_debug` and the four `QuietLogger` exception-dedup methods stored an unbounded `_s
zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service
CVE-2026-47180
### Impact `DNSIncoming._decode_labels_at_offset` recurses once per DNS-name compression pointer (RFC 1035 §4.1.4). Poi
Nerdbank.MessagePack has Inefficient CPU Computation
### Impact Applications that call `OptionalConverters.WithExpandoObjectConverter` and deserialize untrusted data are op