aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers...

CVE-2026-8367

aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (

历史摘要 · 未重新核验 · GitHub Advisory

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2,...

CVE-2026-42926

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set

历史摘要 · 未重新核验 · GitHub Advisory

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When...

CVE-2026-42934

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charse

历史摘要 · 未重新核验 · GitHub Advisory

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh)...

CVE-2026-42408

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a high

历史摘要 · 未重新核验 · GitHub Advisory

A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an...

CVE-2026-42780

A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high pr

历史摘要 · 未重新核验 · GitHub Advisory

wger has an Uncontrolled Resource Consumption issue

### Summary Any authenticated user can create a routine spanning an arbitrarily long date range (e.g. 100 years) and th

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode

CVE-2026-45148

### Summary The advisory `GHSA-c77m-r996-jr3q` patched `getBookmark` so that, when invoked by a publish-mode `RoleReade

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

CVE-2026-45147

### Summary `POST /api/tag/getTag` is registered with `model.CheckAuth` only, omitting both `model.CheckAdminRole` and

历史摘要 · 未重新核验 · GitHub Advisory

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

CVE-2026-44796

### Impact Nautobot UI object-bulk-rename endpoints (for example, `/dcim/interfaces/rename/`) were vulnerable to applic

历史摘要 · 未重新核验 · GitHub Advisory

Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

CVE-2026-44794

### Impact In the case of inter-object references via `GenericForeignKey` (a pattern allowing an object to reference an

历史摘要 · 未重新核验 · GitHub Advisory

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

CVE-2026-44774

## Summary There is a medium severity vulnerability in Traefik's Kubernetes Gateway API provider that allows a tenant w

历史摘要 · 未重新核验 · GitHub Advisory

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

CVE-2026-44740

### Impact Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, un

历史摘要 · 未重新核验 · GitHub Advisory

OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

CVE-2026-44720

### Overview A critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access

历史摘要 · 未重新核验 · GitHub Advisory

Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect

CVE-2026-44681

### Summary An unauthenticated open redirect in Authlib's `OpenIDImplicitGrant` and `OpenIDHybridGrant` authorization e

历史摘要 · 未重新核验 · GitHub Advisory

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary...

CVE-2025-15463

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all vers

历史摘要 · 未重新核验 · GitHub Advisory

PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to...

CVE-2026-33570

PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normall

历史摘要 · 未重新核验 · GitHub Advisory

SillyTavern has a SSRF vulnerability in the CORS proxy middleware

CVE-2026-44652

## Resolution SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we ex

历史摘要 · 未重新核验 · GitHub Advisory

SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware

CVE-2026-44651

## Resolution Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body. ## Ov

历史摘要 · 未重新核验 · GitHub Advisory

PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when...

CVE-2026-35504

PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communicati

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could...

CVE-2026-44874

A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remo

历史摘要 · 未重新核验 · GitHub Advisory