In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers...

CVE-2026-42526

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0

历史摘要 · 未重新核验 · GitHub Advisory

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is...

CVE-2026-8096

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypa

历史摘要 · 未重新核验 · GitHub Advisory

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

CVE-2026-46338

# Summary `pymdownx.snippets` has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With `restrict_base_pat

历史摘要 · 未重新核验 · GitHub Advisory

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

CVE-2026-45802

### Impact This is a significant Denial of Service (DoS) vulnerability. Any application that uses FPDI to process user-s

历史摘要 · 未重新核验 · GitHub Advisory

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

CVE-2026-45796

## Summary Unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POS

历史摘要 · 未重新核验 · GitHub Advisory

HAX CMS: Denial of Service using Malicious Import Request

CVE-2026-46357

### Summary The HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creati

历史摘要 · 未重新核验 · GitHub Advisory

OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle

CVE-2026-45785

### Summary The BST name-lookup loop in `DirectoryTree.TryGetDirectoryEntry` (`OpenMcdf/DirectoryTree.cs:35-46`) walks d

历史摘要 · 未重新核验 · GitHub Advisory

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

CVE-2026-45784

`CipherCtxRef::cipher_update_inplace` incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers

历史摘要 · 未重新核验 · GitHub Advisory

Trubo: Login callback CSRF/session fixation

CVE-2026-45773

### Impact Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost cal

历史摘要 · 未重新核验 · GitHub Advisory

Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`

Diesel allows users to configure various options for PostgreSQL's `COPY FROM` and `COPY TO` statements. These configurat

历史摘要 · 未重新核验 · GitHub Advisory

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

Diesel allows to register custom aggregate SQL functions for SQLite via the `SqliteAggregate` interface. To store an in

历史摘要 · 未重新核验 · GitHub Advisory

Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching

## AI Disclosure I used an LLM to help review the source code, reason about attack surface, and help draft and refine

历史摘要 · 未重新核验 · GitHub Advisory

Caddy CVE-2026-30852 Fix Bypass

# ## TL;DR CVE-2026-30852 fixed double expansion in `vars_regexp` when the variable key is a placeholder (e.g. `{http

历史摘要 · 未重新核验 · GitHub Advisory

Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation

## Summary A vulnerability in the Kong Ingress Controller (KIC) allows for the unauthorized exfiltration of TLS certifi

历史摘要 · 未重新核验 · GitHub Advisory

HCL Connections contains a broken access control vulnerability that may allow unauthorized user...

CVE-2026-21789

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certai

历史摘要 · 未重新核验 · GitHub Advisory

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free...

CVE-2026-45246

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite p

历史摘要 · 未重新核验 · GitHub Advisory

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability...

CVE-2026-47091

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to r

历史摘要 · 未重新核验 · GitHub Advisory

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows...

CVE-2026-45245

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch

历史摘要 · 未重新核验 · GitHub Advisory

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script...

CVE-2026-45243

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge

历史摘要 · 未重新核验 · GitHub Advisory

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields...

CVE-2026-45231

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, descripti

历史摘要 · 未重新核验 · GitHub Advisory