CVE-2026-90555

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server proce...

EUVD-2026-76862

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting...

CVE-2026-5201

CVE-2026-5201 gdk-pixbuf JPEG加载器中的基于堆的缓冲区溢出 你好，我是Kağan Çapar。我在 gdk-pixbuf 的 JPEG 图像加载器中发现了一个基于堆的缓冲区溢出漏洞，该漏洞影响了几乎所有 Linux 桌面环境。该漏洞被分配了 CVE-2026-5201 ，并且被 Red Hat 确认，CVSS 评分为 7.5（重要） 。 此仓库包含我的完整分析、我从零编写的复现程序，以及来自运行中的 Ubuntu 24.04 LTS 系统的崩溃证据。 | ---|--- CVE| CVE-2026-5201 CWE| CWE-122 — 基于堆的缓冲区溢出...

AWS-Tough-Library-Multiple-CVEs

AWS Tough 库多个 CVE 2025 年 3 月，AWS Labs 的 Tough 库（TUF – The Update Framework 的 Rust 客户端实现）披露了多个安全漏洞。这些问题分别跟踪为 CVE-2025-2885、CVE-2025-2886、CVE-2025-2887 和 CVE-2025-2888，并已在 Tough 0.20.0 版本 中修复。安全工程师可以使用本文档了解每个漏洞的技术细节、代码库中的根本原因以及解决这些问题的补丁。强烈建议所有 Tough = 受信任版本的值。例如，如果当前受信任的根是版本 N，Tough 会接受声称版本为 N+2...

CVE-2024-50482

CVE-2024-50482 Woocommerce Product Design = 1.0.0 - 認証なし任意ファイルアップロード 説明: WordPress用WooCommerce Product Designプラグインは、バージョン1.0.0以前のすべてのバージョンにおいて、ファイルタイプの検証が欠如しているため、任意のファイルアップロードに対して脆弱です。これにより、認証されていない攻撃者が影響を受けるサイトのサーバーに任意のファイルをアップロードする可能性があり、リモートコード実行が可能になる可能性があります。 root@kitploit: Published:...

EUVD-2026-76795

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server...

EUVD-2026-76811

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

EUVD-2026-76783

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution...

EUVD-2026-76741

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

CVE-2025-6058

⚡ WPBookit = 1.0.4 - 未认证任意文件上传 📝 描述 WordPress 的 WPBookit 插件在 imageuploadhandle 函数中由于缺少文件类型验证而存在任意文件上传漏洞，该函数通过 addbookingtype 路由挂载，影响所有版本（包括 1.0.4 ）。 此漏洞允许未认证的攻击者向受影响站点的服务器上传任意文件，可能导致远程代码执行 。 CVE| CVSS 评分| 公开披露时间| 最后更新时间 ---|---|---|--- CVE-2025-6058| 9.8（严重）| 2025年7月11日| 2025年7月12日 🚀 这个漏洞利用脚本能做什么...

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation Specifically, within the validation pipeline, if an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token ...

CVE-2026-45057

CVE-2026-45057 affects the matrix-sdk-ui Rust crate (part of matrix-rust-sdk) prior to version 0.16.1 . The message edit validation logic is missing a check: when replacing an encrypted event, the replacement event is not required to be encrypted itself. This allows a malicious homeserver adminis...

CVE-2026-89701

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89438

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

EUVD-2026-76688

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2021-41730

TENDA 認証リモートコマンド実行 エクスプロイト作者: SHENGXI [email protected] ベンダー: TENDA CVE-2021-41730 - /bin/httpd ファームウェアバージョン: AC15: =USAC15V1.0BRV15.03.05.20multiTDE01.bin AC6: USAC6V1.0BRV15.03.05.16multiTD01.bin ....... ハードウェアリンク: https://www.tendacn.com/en/download/detail-3858.html 脆弱性の詳細...

EUVD-2026-76613

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89701 nfsd: validate nseconds in TIME_DELEG decode paths

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89701

CVE-2026-89701 is a validation flaw in the Linux kernel's nfsd (NFS server daemon). The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode paths store a raw uint32_t nseconds value directly into tv_nsec without enforcing the nseconds

CVE-2026-89611 ntfs: validate non-resident attribute offsets

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...