检索 GitHub Advisory Database 中的已审查与未审查安全公告。
| 公告编号 | 摘要 | 级别 | 生态 / 软件包 | 审查状态 | 发布时间 | 修改时间 |
|---|---|---|---|---|---|---|
| GHSA-FP6W-8WPG-74G5 | stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback | 严重 | PyPIstigmem-node | 已审查 | 2026-05-30 06:13 | 2026-05-30 06:13 |
| GHSA-6X26-5727-RRM9 CVE-2026-47268 | Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host |
当前筛选结果 35,190 条 · 时间按北京时间显示
| 中危 |
Gogithub.com/naiba/nezha+1 |
| 已审查 |
| 2026-05-30 06:10 |
| 2026-06-27 05:28 |
| GHSA-XW54-C3MX-9PM3 CVE-2026-47233 | Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 | 中危 | Packagistadmidio/admidio | 已审查 | 2026-05-30 06:09 | 2026-05-30 06:09 |
| GHSA-MCH8-WF3H-6X88 CVE-2026-47234 | Admidio writes session IDs and auto-login cookie values to application logs | 中危 | Packagistadmidio/admidio | 已审查 | 2026-05-30 06:07 | 2026-05-30 06:07 |
| GHSA-4RGQ-38MH-9XQG CVE-2026-47232 | Admidio PKCS#12 private key export action lacks CSRF protection | 中危 | Packagistadmidio/admidio | 已审查 | 2026-05-30 06:07 | 2026-05-30 06:07 |
| GHSA-X628-457G-2PW9 CVE-2026-47231 | Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders | 高危 | Packagistadmidio/admidio | 已审查 | 2026-05-30 06:06 | 2026-05-30 06:06 |
| GHSA-Q6W3-HPFV-RG36 CVE-2026-47230 | Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders | 中危 | Packagistadmidio/admidio | 已审查 | 2026-05-30 06:05 | 2026-05-30 06:05 |
| GHSA-XG76-5QJ2-2HHV CVE-2026-47229 | Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation | 中危 | Packagistadmidio/admidio | 已审查 | 2026-05-30 06:01 | 2026-05-30 06:01 |
| GHSA-MX25-J3RC-6W2W CVE-2026-47228 | Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords | 中危 | Packagistadmidio/admidio | 已审查 | 2026-05-30 05:58 | 2026-05-30 05:58 |
| GHSA-RWJR-QJJ3-MQ2F CVE-2026-47227 | Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php` | 中危 | Packagistadmidio/admidio | 已审查 | 2026-05-30 05:57 | 2026-05-30 05:57 |
| GHSA-QC4C-HRMC-4F78 CVE-2026-47226 | Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges | 中危 | Packagistadmidio/admidio | 已审查 | 2026-05-30 05:54 | 2026-06-09 18:35 |
| GHSA-XJHV-PP2R-6F82 CVE-2026-47213 | BoxLite has a Timeout Bypass Vulnerability | 中危 | PyPIboxlite | 已审查 | 2026-05-30 05:45 | 2026-06-11 22:07 |
| GHSA-55RJ-X2VC-4WHQ CVE-2026-47212 | Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification | 中危 | Packagistsymfony/symfony+1 | 已审查 | 2026-05-30 05:32 | 2026-05-30 05:32 |
| GHSA-3GGM-C5M7-HFV5 CVE-2026-48557 | Spatie Laravel Media Library contains a file upload restriction bypass | 高危 | Packagistspatie/laravel-medialibrary | 已审查 | 2026-05-30 05:31 | 2026-07-03 05:02 |
| GHSA-FGGG-964J-3J7H CVE-2026-48555 | Spatie Laravel Media Library contains a server-side request forgery vulnerability | 中危 | Packagistspatie/laravel-medialibrary | 已审查 | 2026-05-30 05:31 | 2026-07-03 05:12 |
| GHSA-C4M7-2GWP-VW76 CVE-2026-47211 | ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env | 高危 | PyPIouroboros-ai | 已审查 | 2026-05-30 05:22 | 2026-05-30 05:22 |
| GHSA-HJJ4-HFJM-FMRJ CVE-2026-47203 | Authelia Missing Username Canonicalization in Basic Auth (LDAP) | 低危 | Gogithub.com/authelia/authelia/v4 | 已审查 | 2026-05-30 05:21 | 2026-06-27 05:32 |
| GHSA-C3M2-JQMQ-PVP3 CVE-2026-47201 | authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user | 高危 | Gogoauthentik.io | 已审查 | 2026-05-30 04:25 | 2026-06-09 19:00 |
| GHSA-5JH9-2H63-PW4Q CVE-2026-47695 | CC-Tweaked has an SSRF Protection Bypass with NAT64 | 高危 | Mavencc.tweaked:cc-tweaked-1.19.3-core+7 | 已审查 | 2026-05-30 04:21 | 2026-05-30 04:21 |
| GHSA-RFG2-PJW2-56X2 CVE-2026-47184 | zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood | 中危 | PyPIzeroconf | 已审查 | 2026-05-30 04:18 | 2026-05-30 04:18 |
| GHSA-PHVX-9MGW-67R5 CVE-2026-47183 | zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion | 中危 | PyPIzeroconf | 已审查 | 2026-05-30 04:13 | 2026-05-30 04:13 |
| GHSA-9PGC-3CCV-5297 CVE-2026-47180 | zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service | 中危 | PyPIzeroconf | 已审查 | 2026-05-30 04:09 | 2026-05-30 04:09 |
| GHSA-92VJ-HP7M-GWCJ | Nerdbank.MessagePack has Inefficient CPU Computation | 中危 | NuGetNerdbank.MessagePack | 已审查 | 2026-05-30 04:02 | 2026-05-30 04:02 |
| GHSA-7J2F-6H2R-6CQC CVE-2026-47260 | Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs | 高危 | Packagistphanan/koel | 已审查 | 2026-05-30 03:56 | 2026-06-13 06:01 |
| GHSA-QJVR-435C-5FJH | Nerdbank.MessagePack has a memory amplification DoS in collection deserialization | 中危 | NuGetNerdbank.MessagePack | 已审查 | 2026-05-30 03:55 | 2026-05-30 03:55 |