Applications built on MongoDB Entity Framework Core Provider which combine independent encryption...
CVE-2026-92756
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this prov
#severity:medium
共收录 5477 条相关情报。
← 返回所有主题Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
CVE-2026-75834
## Vulnerability Details **Component**: getgrav/grav core **File**: `system/src/Grav/Common/Security.php` **Function**:
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
CVE-2026-86000
## Summary soupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared `IDENTIFI
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
CVE-2026-85999
## Summary Before tokenizing, `selector_iter` trims leading/trailing whitespace and comments by running two regexes ove
@platejs/core HTML deserialization can trigger browser behavior during parsing
CVE-2026-88976
### Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML a
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
CVE-2026-81871
### Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creat
Steeltoe: Header-forwarded client cert lacks proof of private-key possession
CVE-2026-81868
### Summary When Steeltoe's certificate-based authorization (`UseCertificateAuthorization`) is configured, the default
Svelte devalue: DoS via malformed input
CVE-2026-81176
### Impact `devalue.parse` prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient...
CVE-2026-89064
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versi
Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the ...
CVE-2026-92595
Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAcc
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the...
CVE-2026-92589
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video...
CVE-2026-92585
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability...
CVE-2026-92590
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git...
CVE-2026-92587
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relativ
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the...
CVE-2026-92588
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endp
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video...
CVE-2026-92586
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the se
In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values...
CVE-2026-92581
In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowin
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting...
CVE-2026-92584
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticat
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to...
CVE-2026-92583
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt...
CVE-2026-92579
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without