GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7,...
CVE-2026-8716
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, an
#severity:medium
共收录 5624 条相关情报。
← 返回所有主题Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
CVE-2026-45075
### Description Symfony's `#[IsGranted('...')]`, `#[IsSignatureValid]`, and `#[IsCsrfTokenValid(...)]` attributes allow
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
CVE-2026-45074
`Cas2Handler` builds this `service` parameter from `Request::getSchemeAndHttpHost()`, which reflects the attacker-contro
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
CVE-2026-45073
### Description `Symfony\Component\Cache\Adapter\PdoAdapter` is the PDO-backed cache adapter. Its `clear($prefix)` meth
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
CVE-2026-45070
### Description `Symfony\Component\Mime\Header\ParameterizedHeader` (and the related parameter handling reachable from
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
CVE-2026-45069
### Description `OidcTokenHandler` is Symfony's built-in access-token handler for OpenID Connect: it validates a bearer
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
CVE-2026-45068
### Description Symfony Mailer selects a transport via the `MAILER_DSN` environment variable / configuration (e.g. `smt
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
CVE-2026-45066
### Description `symfony/html-sanitizer` lets applications sanitise untrusted HTML. The configuration methods `allowLin
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
CVE-2026-45064
### Description `Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse()` (used by `UrlSanitizer::sanitize(
CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression
CVE-2026-44981
The LAPI router uses `gin-contrib/gzip` with `DefaultDecompressHandle` globally (`pkg/apiserver/controllers/controller.g
A vulnerability was detected in TeamSpeak 3 Server up to 3.13.7. This issue affects some unknown...
CVE-2026-4392
A vulnerability was detected in TeamSpeak 3 Server up to 3.13.7. This issue affects some unknown processing of the compo
A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.7. This vulnerability...
CVE-2026-4391
A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.7. This vulnerability affects unknown code o
A weakness has been identified in TeamSpeak 3 Server up to 3.13.7. This affects the function...
CVE-2026-4390
A weakness has been identified in TeamSpeak 3 Server up to 3.13.7. This affects the function process_resend_queue of the
Missing Authorization vulnerability in Mamunur Rashid The Post Grid allows Exploiting Incorrectly...
CVE-2026-49054
Missing Authorization vulnerability in Mamunur Rashid The Post Grid allows Exploiting Incorrectly Configured Access Cont
A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of...
CVE-2026-38931
A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of creatorsofcode simplephp
Missing Authorization vulnerability in Bizswoop Account Manager for WooCommerce allows Exploiting...
CVE-2022-41656
Missing Authorization vulnerability in Bizswoop Account Manager for WooCommerce allows Exploiting Incorrectly Configured
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
CVE-2026-45334
### TL;DR This vulnerability affects all Kirby sites that restrict the visibility of users for certain roles via the `u
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
CVE-2026-45065
### Description Symfony routes can declare a requirements regex per path parameter, e.g. a route `/{_locale}/blog` with
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-49044
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advan
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d...
CVE-2026-9674
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows atta