cvelistV5

注意 2026-2-17 为日期规范化增加额外一天的处理时间，以解决潜在的不一致问题 新的日期规范化时间表：（2026年2月16日 - 2026年2月28日） 注意 2026-2-10 记录日期规范化deltaLog.json 文件变更 deltaLog.json 文件通常保留滚动 30 天的 CVE 记录修改历史。然而，在日期规范化过程（2026年2月16日 - 2026年2月28日）期间，deltaLog.json 文件将暂时只保留 15 天的历史记录。由于大量记录将被修改，这将限制 deltaLog.json...

LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7. id: CVE-2023-40000 info: name: LiteSpeed Cache = 5.7 - Unauthenticated Stored XSS...

Extreme Management Center 8.4.1.24 - Cross-Site Scripting

Extreme Management Center 8.4.1.24 contains a cross-site scripting vulnerability via a parameter in a GET request. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection

Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30,...

Vite - Arbitrary File Read

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...

XWiki Platform - SQL Injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

Juniper Web Device Manager - Cross-Site Scripting

Juniper Web Device Manager J-Web in Junos OS contains a cross-site scripting vulnerability. This can allow an unauthenticated attacker to run malicious scripts reflected off J-Web to the victim's browser in the context of their session within J-Web, which can allow the attacker to steal...

GitLab CE/EE - Information Disclosure

GitLab CE/EE is susceptible to information disclosure. An attacker can access runner registration tokens using quick actions commands, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. Affected versions are from 12.10 before 14.6.5,...

CVE-2026-53495

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.1...

TFTPlunder

TFTPlunder：针对 CVE-2023-29930 的利用工具 这是一个针对 Genesys（原 InIn）TFTP 配置服务器中盲目文件读/写漏洞的利用脚本。 漏洞信息 此漏洞源于对 TFTP 根路径和文件扩展名的配置选项未加限制。换句话说，通过管理界面，你可以将 TFTP 更改为任意目录，并随意上传或下载任何文件。 （但请注意，TFTP 作为一种协议不允许列出文件，这使得漏洞成为 盲目 文件读取漏洞。） 更严重的是，该服务器默认使用硬编码的已知凭据，且不强制用户更改它们。 从分类角度看，它涉及以下 CWE 的方面： CWE-22：路径名限制不当（路径遍历）...

CVE-2026-13276

IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity Access Container 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001...

WS_FTP-CVE-2023-40044

WSFTP-CVE-2023-40044 本仓库包含我追踪WSFTP CVE-2023-40044影响的所有内容 包括可能受影响的组织和使用了头部方法的域名。 我还构建了一个新闻滚动条，追踪关于MOVEit和WSFTP的最新报道，可在 https://firehose.kenbuckler.com/moveit 获取。...

MOVEit-CVE-2023-34362

MOVEit-CVE-2023-34362 包含我追踪 MOVEit CVE-2023-34362 影响的所有内容的仓库 包括可能受影响的组织和利用 SFTP Header 及 Cookie 发现方法的域名。 我还构建了一个新闻滚动条，用于追踪 MOVEit 的最新报道，访问地址：https://firehose.kenbuckler.com/moveit...

Astra Linux – Vulnerability in Mariadb 10.3

Vulnerability in the MySQL Client product of Oracle MySQL component: Client: mysqldump. The supported versions affected are 8.0.0–8.0.41, 8.4.0–8.4.4, and 9.0.0–9.2.0. This vulnerability is difficult to exploit; it allows low-privilege attackers with network access via multiple protocols to...

Astra Linux – Vulnerability in Thunderbird, Firefox

An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages. This bug only affects Thunderbird for Linux. Other operating systems are unaffected.. This vulnerability affects Firefox 108, Firefox ESR 102.6, and...

Astra Linux – Vulnerability in Firefox and Thunderbird

By using a link with rel="localization", a use-after-free could occur if an object is destroyed during JavaScript execution, and then the object is referenced through a freed pointer, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 91.8, Firefox 99, and Firefo...

Astra Linux – Vulnerability in Firefox and Thunderbird

Cross-compartment wrappers used to wrap a scripted proxy might have caused objects from other compartments to be stored in the main compartment, resulting in a “use-after-free” vulnerability. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13...

Astra Linux – Vulnerability in Samba

A null pointer dereference flaw was detected in Samba’s Winbind service in versions prior to 4.11.15, before 4.12.9, and before 4.13.1. A local user could exploit this flaw to crash the Winbind service, resulting in a denial of service...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could cause a select dropdown menu to be displayed over another tab; this could lead to user confusion and potential spoofing attacks. This vulnerability affects Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird 128.5...

Astra Linux – Vulnerability in HAPProxy

A issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. This issue can lead to a situation where the HTTP Host header is controlled by an attacker, due to a mismatch between the Host field and its corresponding authority value being mishandled...