最新漏洞情报100

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

lopdf has a stack overflow via deeply nested PDF objects

JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

gomarkdown/markdown IsSafeURL panics on short URLs

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Qwik: Crashing any Qwik Server via Resource thenable

containerd CRI plugin: Checkpoint restore bypasses destination security context

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Vitess vttablet /twopcz reflected XSS

mise permits untrusted local configuration to override default shell arguments

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

BeyondTrust Remote Support未充分验证数据可靠性漏洞

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

NGINX Plus和NGINX Open Source ngx_http_core_module 远程代码执行漏洞

Cisco Secure Email Gateway 相对路径遍历漏洞(CVE-2026-76519)

Palo Alto Networks PAN-OS 远程代码执行漏洞(CVE-2026-0322)

Collabora Online Built-in CODE Server proxy.php 命令注入漏洞

Cisco Secure Email Gateway 命令注入漏洞

Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability

Microsoft Security Advisory CVE-2026-96235 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability

Microsoft Security Advisory CVE-2026-96231 - .NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

Windows 健康与优化体验服务权限提升漏洞 (CVE-2026-85884)

Wazuh manager命令注入漏洞

Wazuh manager文件读取漏洞

GitLab CE/EE 远程代码执行漏洞

ICS认证绕过执行命令漏洞(CVE-2026-104935)

GitLab CI配置正则编译远程代码执行漏洞（CVE-2026-97229）

Linux kernel 7.2 account_mm_sched()释放后重用代码问题漏洞

Floci VtlTemplateEngine 代码注入漏洞

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Tina: Code injection via unescaped Git branch name in generated client source

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

Contao: Cross-site scripting in the comments bundle

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

Vikunja: Unbounded CSV row cardinality permits API process termination

Vikunja: Unbounded nested task-filter recursion permits API process termination

Vikunja: Denial of service via decompression bomb in the data import

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover