IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security...
CVE-2026-18869
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access inte
#severity:medium
共收录 5477 条相关情报。
← 返回所有主题IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP...
CVE-2026-11722
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vuln
IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive...
CVE-2026-11540
IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the fil
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP...
CVE-2026-11548
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vuln
IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due...
CVE-2026-11710
IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of
Obot: MCP Registry API readable without authentication
## Summary In affected versions, enabling registry authentication (`OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`) does not ac
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
CVE-2026-71537
### Summary The service downgrade implementation in `app/Livewire/Services/Upgrade.php::doUpgrade()` executes a prorati
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
CVE-2026-77339
## Summary A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener wh
md-editor-v3: XSS via fenced-code language rendering bypass
CVE-2026-84992
### Summary `MdPreview` interpolates a fenced-code language into HTML attributes without escaping it. A crafted info str
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets
CVE-2026-63406
### Summary The telemetry subsystem embeds a hardcoded auth token (`"secret"`) in the public source and transmits raw CL
AnyIO process-pool workers can block indefinitely on undrained stderr
CVE-2026-64847
### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redi
AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body
CVE-2026-63405
### Summary The Pusher-compatible REST API includes `body_md5` in the HMAC signature string but never computes or verifi
Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
CVE-2026-61795
### Summary A parameter order bug in `internal/webhook/tenant/validation/hostname_regex.go` causes the `hostnameRegexHa
Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
CVE-2026-61794
### Summary A validation bug in `internal/webhook/tenant/validation/forbidden_annotations_regex.go` allows an invalid `F
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)
### Summary Special:FacetedSearch `cstate` hidden inputs enable reflected XSS (residual of CVE-2025-10354) ### Details
A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue...
CVE-2026-93371
A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function Ne
The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css...
CVE-2026-14855
The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the...
CVE-2026-92991
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in variou
The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable...
CVE-2026-15650
The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site S
The Photos app's filter-based "smart albums" build their file listing using the search...
CVE-2026-82985
The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolder