GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
CVE-2026-118384
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
#severity:medium
共收录 5506 条相关情报。
← 返回所有主题LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to...
CVE-2026-118372
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host...
CVE-2026-118373
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP UR
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin...
CVE-2026-117605
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAd
GROWI contains a missing authorization check vulnerability in its collaborative editing feature....
CVE-2026-115624
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vuln
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new(...
CVE-2026-118371
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url()
Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader()...
CVE-2026-117608
Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers t
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated...
CVE-2026-117606
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate ot
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &...
CVE-2026-107625
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos...
CVE-2026-109974
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos...
CVE-2026-109209
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable...
CVE-2026-107745
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file d
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows...
CVE-2013-20009
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra...
CVE-2026-22063
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function...
CVE-2026-118128
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdat
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
CVE-2026-116691
### Summary `mlflow.crewai.autolog()` leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI `A
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/en...
CVE-2026-116773
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the c
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash...
CVE-2026-116695
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectl
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
CVE-2026-116684
### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issue
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
CVE-2026-116694
## Summary `JaegerPropagator.extract()` in `opentelemetry-propagator-jaeger` did not enforce limits when extracting inb