Distribution: Client `manifests.Get()` does not verify returned content against requested digest
CVE-2026-85747
### Summary `registry/client.(*manifests).Get(ctx, dgst, …)` fetches a manifest by digest but never hashes the returned
#severity:medium
共收录 5527 条相关情报。
← 返回所有主题Backstage: Improper access control in backend action invocation
CVE-2026-106495
### Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Exist
Appium: Symlink based Zip Slip in @appium/support ZIP extraction
CVE-2026-103975
### Summary CVE-2026-30973 [(GHSA-rfx7-4xw3-gh4m)](https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
CVE-2026-100350
### Summary `openapi3filter` decodes `deepObject`-style query parameters by looping over **every** key in the request's
tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
CVE-2026-104266
### Impact An M4A file containing a sub-atom with a size of zero in the `----` atom makes the parser enter an infinite l
copyparty FTP: upload outside defined volumes (limited path traversal)
CVE-2026-104102
The FTP and FTPS server -- if enabled -- would allow uploading to any folder that the copyparty process had permission t
unstructured: Stored XSS via unescaped HTML generation
CVE-2026-104250
### Summary When `unstructured` parses an untrusted document and outputs the result as HTML, malicious markup contained
kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
CVE-2026-100348
The defect ---------- Confirmed at HEAD (f0407d5, v0.144.0). openapi3/loader.go, inside resolveComponent's drill closure
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
CVE-2026-100347
## Summary The `openapi3filter.ValidationHandler` (the exported, documented request-validation middleware) hard-wires th
Gotify: Insufficiently Protected Password Change endpoint
CVE-2026-102603
The password change endpoint (`POST /current/user/password`) in Gotify versions <= 2.9.1 does not require knowledge of t
A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
CVE-2026-76662
A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP...
CVE-2026-110909
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the cu
A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote ...
CVE-2026-76656
A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as...
CVE-2026-110904
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostr
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows...
CVE-2026-110866
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its...
CVE-2026-110870
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fail
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better...
CVE-2026-110861
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create...
CVE-2026-110851
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication...
CVE-2026-110852
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which...
CVE-2026-110860
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination o