A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor...
CVE-2026-73762
A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing
#severity:medium
共收录 5482 条相关情报。
← 返回所有主题A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to...
CVE-2026-73756
A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive informati
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
CVE-2026-84306
A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be
pypdf: Possible long runtimes/large memory usage when retrieving outlines
CVE-2026-84310
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consum
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
CVE-2026-84311
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consum
pypdf: Possible infinite loop for TreeObject.insert_child
CVE-2026-84309
### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a (us
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
CVE-2026-84305
### Summary When SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the curr
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
CVE-2026-84371
### Summary When SVG animation is allowed, `attributeName="href"` makes `values` a list of URL destinations. `sanitize-h
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
## Description ### Summary `parse_multipart_form_data` (httputil.py:34) calls `data.split(b"--"+boundary+b"\r\n")` **b
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
CVE-2026-73228
## Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level `re
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
CVE-2026-73229
Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Re
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
CVE-2026-58191
## Summary Appium's base-driver mounts the built-in `/test/guinea-pig`, `/test/guinea-pig-scrollable` and `/test/guinea
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
CVE-2026-62993
When a Security policy is active, {fetch} validates the requested remote URL against the trusted_uri allowlist via Secur
Kirby: System path exposure from error messages in the REST API
CVE-2026-69127
### TL;DR This vulnerability affects all Kirby sites that have not disabled the REST API with the `'api' => false` opti
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality...
CVE-2026-67395
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validati
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the...
CVE-2026-82957
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptio
A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability...
CVE-2026-82922
A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_up
A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function...
CVE-2026-82921
A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
CVE-2026-45822
### Impact An attacker who can supply input to `decodeUriComponent()` (directly or via a dependency that uses this packa
A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This...
CVE-2026-82914
A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown cod