Indico: Missing access check in legacy session export API
CVE-2026-107395
### Impact A legacy API to retrieve session details could be misused to retrieve metadata (such as title, description an
#severity:medium
共收录 5534 条相关情报。
← 返回所有主题Indico: Cross-Site-Scripting in minutes editor
CVE-2026-107397
### Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent ed
Indico: Cross-Site-Scripting in link fields
CVE-2026-107396
### Impact There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs. ### Patches You sho
AdonisJS: Unencoded route parameters can produce open redirects
CVE-2026-107718
Route parameters are inserted into generated URLs without URI encoding. When an application passes untrusted input to a
Mechanize sends credential headers to another origin after a meta refresh
CVE-2026-107399
## Summary `mechanize` applied no trust boundary to a `meta` refresh, so credentials set through `Mechanize#request_hea
Mechanize sends credential headers to another host after an HTTP redirect
CVE-2026-107715
## Summary `mechanize` leaked credentials to the redirect target when an HTTP redirect crossed to another host. Credent
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
CVE-2026-107721
## Summary `createVerifier({ clockTolerance: Infinity })` silently bypasses both `exp` (expiry) AND `nbf` (not-before)
PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization
CVE-2026-61440
# Platform members can rewrite shared labels and owner issue labels without owner/admin authorization ## Summary `prai
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0...
CVE-2026-78388
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cro
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
CVE-2026-107391
### Summary `StsdAtom.get()` in `lib/mp4/AtomToken.ts` parses an MP4 `stsd` (sample description) box's entry table by a
music-metadata: Uncontrolled memory allocation in APEv2 parser
CVE-2026-107387
## Summary `music-metadata` 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser. The parser re
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
CVE-2026-107388
### Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requ
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
CVE-2026-107389
## Summary The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer (VINT) element lengths wit
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav...
CVE-2026-5049
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local a
A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin...
CVE-2026-5769
A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintex
In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API...
CVE-2026-5048
In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability
An OS command injection vulnerability exists in the account management subsystem of Brocade...
CVE-2026-87677
An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates...
CVE-2026-107450
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_li
An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session...
CVE-2026-94579
An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines durin
Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache...
CVE-2026-87661
Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data dur