搜尋
456 筆結果- LOW3.7CVE-2026-44489Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
- LOW2.0CVE-2026-46549NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
- LOW3.7CVE-2026-45232EPSS 0.04%Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in s…
- LOW3.7CVE-2026-43514EPSS 0.10%Apache Tomcat - AJP secret compared in non-constant time
- LOW3.7CVE-2026-44572EPSS 0.01%Next.js's Middleware / Proxy redirects can be cache-poisoned
- LOW3.7CVE-2026-44582EPSS 0.01%Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
- LOW3.8CVE-2026-44459EPSS 0.02%Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
- LOW3.7CVE-2026-44589EPSS 0.04%nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
- LOW3.7CVE-2026-44242EPSS 0.05%Micronaut has Unbounded `bundleCache` in `ResourceBundleMessageSource` that Allows Memory Exhaustion via `Accept-Language` Header
- LOW3.7CVE-2026-8026EPSS 0.02%Flowise: Bcrypt Password Hash Exposure
- LOW2.4CVE-2026-42188EPSS 0.03%Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser
- LOW3.7CVE-2026-42040EPSS 0.06%Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
- LOW3.7CVE-2026-3832EPSS 0.02%A flaw was found in gnutls.
- LOW3.7CVE-2026-5419EPSS 0.04%A flaw was found in gnutls.
- LOW3.7CVE-2026-7303EPSS 0.07%xxl-job has a Resource Injection issue
- LOW3.7CVE-2026-40969EPSS 0.06%Spring gRPC AuthenticationException messages are reflected to remote client
- LOW2.2CVE-2026-41321EPSS 0.05%Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)
- LOW3.7CVE-2026-22746EPSS 0.07%Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
- LOW3.7CVE-2026-33877EPSS 0.03%ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
- LOW3.5CVE-2026-6216EPSS 0.04%DbGate has cross site scripting via the SVG Icon String Handler component
- LOW3.7CVE-2026-41913EPSS 0.08%OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths
- LOW3.7CVE-2026-34166EPSS 0.02%LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter
- LOW3.7CVE-2026-39321EPSS 0.03%Parse Server has a login timing side-channel reveals user existence
- LOW3.7CVE-2026-41407EPSS 0.04%OpenClaw: Shared-secret comparison call sites leaked length information through timing
- LOW2.8CVE-2026-34781EPSS 0.01%Electron: Crash in clipboard.readImage() on malformed clipboard image data
第 1 / 19 頁下一頁 →