检索 GitHub Advisory Database 中的已审查与未审查安全公告。
| 公告编号 | 摘要 | 级别 | 生态 / 软件包 | 审查状态 | 发布时间 | 修改时间 |
|---|---|---|---|---|---|---|
| GHSA-J4FX-XXWH-2485 CVE-2026-8657 | jsondiffpatch patch APIs are vulnerable to prototype pollution | 高危 | npmjsondiffpatch | 已审查 | 2026-05-16 14:30 | 2026-09-01 06:10 |
| GHSA-J76W-P754-G2W7 CVE-2026-4054 | Mattermost doesn't validate the response body of proxied images |
当前筛选结果 35,190 条 · 时间按北京时间显示
| 中危 |
Gogithub.com/mattermost/mattermost-server |
| 已审查 |
| 2026-05-16 05:31 |
| 2026-05-29 03:28 |
| GHSA-HW87-6JCQ-9F8Q CVE-2026-4053 | Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields | 低危 | Gogithub.com/mattermost/mattermost-server | 已审查 | 2026-05-16 05:31 | 2026-05-29 03:26 |
| GHSA-WJ3Q-VW2V-3RJ3 | Duplicate Advisory: phpMyFAQ: SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS 已撤回 | 中危 | PackagistphpMyFAQ/phpMyFAQ+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:03 |
| GHSA-W9MJ-GFRM-HJ5X | Duplicate Advisory: phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check 已撤回 | 高危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:01 |
| GHSA-W42G-JJ8W-FJ77 | Duplicate Advisory: phpMyFAQ: Stored XSS via Utils::parseUrl() in comment rendering 已撤回 | 高危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 07:58 |
| GHSA-RMQR-H98C-QG2M | Duplicate Advisory: phpMyFAQ: Path traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins 已撤回 | 高危 | PackagistphpMyFAQ/phpMyFAQ | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:00 |
| GHSA-P9WC-4PJV-RG82 | Duplicate Advisory: phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields 已撤回 | 高危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:02 |
| GHSA-P26V-FX3X-R2RP | Duplicate Advisory: phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User 已撤回 | 中危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:03 |
| GHSA-H36G-93QX-RXGR | Duplicate Advisory: phpMyFAQ: Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization 已撤回 | 中危 | PackagistphpMyFAQ/phpMyFAQ+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:00 |
| GHSA-CQRW-J4QC-7F9W | Duplicate Advisory: phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query 已撤回 | 高危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 07:59 |
| GHSA-CH9Q-C9MP-J5GQ | Duplicate Advisory: phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha 已撤回 | 严重 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 07:57 |
| GHSA-9R8R-X3VG-6XH4 | Duplicate Advisory: phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check 已撤回 | 中危 | PackagistphpMyFAQ/phpMyFAQ+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:01 |
| GHSA-6626-79JH-5CCR | Duplicate Advisory: phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id 已撤回 | 严重 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:00 |
| GHSA-5H62-F8FG-4W7Q | Duplicate Advisory: phpMyFAQ: Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags 已撤回 | 中危 | PackagistphpMyFAQ/phpMyFAQ+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:05 |
| GHSA-478M-MRW4-QF2W | Duplicate Advisory: phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering 已撤回 | 高危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:02 |
| GHSA-C3CH-22RQ-XFWR CVE-2026-45619 | AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf` | 中危 | PackagistWWBN/AVideo | 已审查 | 2026-05-16 02:35 | 2026-06-09 18:28 |
| GHSA-3MV2-VMWH-RWFX CVE-2026-45610 | AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA | 中危 | PackagistWWBN/AVideo | 已审查 | 2026-05-16 02:34 | 2026-06-09 18:27 |
| GHSA-M5J4-7R85-2CJ2 CVE-2026-45580 | AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute | 中危 | PackagistWWBN/AVideo | 已审查 | 2026-05-16 02:33 | 2026-06-09 18:27 |
| GHSA-XW67-CG5F-4M2R CVE-2026-45578 | AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL | 高危 | PackagistWWBN/AVideo | 已审查 | 2026-05-16 02:32 | 2026-06-09 18:27 |
| GHSA-GQX7-6552-67HF CVE-2026-45575 | Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client | 高危 | Mavencom.oviva.telematik:epa4all-client | 已审查 | 2026-05-16 02:30 | 2026-06-09 07:31 |
| GHSA-CH4J-VCF5-58X5 CVE-2026-23695 | Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option | 中危 | Packagistcockpit-hq/cockpit | 已审查 | 2026-05-16 02:30 | 2026-05-22 04:26 |
| GHSA-2F54-V4HM-FX73 CVE-2026-35194 | Apache Flink: Remote code execution via SQL injection in code generation | 高危 | Mavenorg.apache.flink:flink-table-api-java+2 | 已审查 | 2026-05-16 02:30 | 2026-05-22 23:49 |
| GHSA-5HHF-XMFX-4VVR CVE-2026-45574 | epa4all-client: TLS Certificate Validation Disabled in Production | 高危 | Mavencom.oviva.telematik:epa4all-client | 已审查 | 2026-05-16 02:29 | 2026-06-09 07:35 |
| GHSA-MQ5J-PW29-JCV3 CVE-2026-46383 | Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install` | 中危 | PyPIapm-cli | 已审查 | 2026-05-16 02:25 | 2026-05-16 07:50 |