检索 GitHub Advisory Database 中的已审查与未审查安全公告。
| 公告编号 | 摘要 | 级别 | 生态 / 软件包 | 审查状态 | 发布时间 | 修改时间 |
|---|---|---|---|---|---|---|
| GHSA-R945-H4VM-H736 CVE-2026-42843 | Grav API Privilege Escalation to Super Admin | 高危 | Packagistgetgrav/grav-plugin-api | 已审查 | 2026-05-06 05:20 | 2026-05-13 22:04 |
| GHSA-838G-GR43-QQG9 CVE-2026-42315 | PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data |
当前筛选结果 35,190 条 · 时间按北京时间显示
| 高危 |
PyPIpyload-ng |
| 已审查 |
| 2026-05-06 05:18 |
| 2026-06-09 03:48 |
| GHSA-3QPQ-R242-JQJ7 CVE-2026-44167 | phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID() | 高危 | Packagistphpseclib/phpseclib | 已审查 | 2026-05-06 05:17 | 2026-05-14 00:27 |
| GHSA-PQ7P-MC74-G65W CVE-2026-44166 | PocketBase vulnerable to account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade | 中危 | Gogithub.com/pocketbase/pocketbase | 已审查 | 2026-05-06 05:17 | 2026-05-14 00:26 |
| GHSA-8757-69J2-HX56 CVE-2026-43891 | changedetection.io has an Arbitrary Local File Read via a crafted backup restore | 高危 | PyPIchangedetection.io | 已审查 | 2026-05-06 05:16 | 2026-06-05 22:31 |
| GHSA-JXH8-JH77-XH6G | @evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts | 高危 | npm@evomap/evolver | 已审查 | 2026-05-06 05:15 | 2026-05-06 05:15 |
| GHSA-7XP7-M392-H92C | @evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS | 中危 | npm@evomap/evolver | 已审查 | 2026-05-06 05:15 | 2026-05-06 05:15 |
| GHSA-CFCJ-HQPF-HCCF | @evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE) | 高危 | npm@evomap/evolver | 已审查 | 2026-05-06 05:15 | 2026-05-06 05:15 |
| GHSA-9FW6-XGG2-MQ9Q | Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled | 高危 | Gogithub.com/apernet/hysteria/core/v2 | 已审查 | 2026-05-06 05:14 | 2026-05-06 05:14 |
| GHSA-97R3-5W84-R4Q8 CVE-2026-42314 | PyLoad Vulnerable to Path Traversal via Package Folder Name | 中危 | PyPIpyload-ng | 已审查 | 2026-05-06 05:13 | 2026-06-09 03:48 |
| GHSA-GRGV-6HW6-V9G4 CVE-2026-42304 | Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains | 高危 | PyPITwisted | 已审查 | 2026-05-06 05:12 | 2026-06-09 04:05 |
| GHSA-QX5F-GHC2-7G5C CVE-2026-42303 | Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection | 中危 | PyPIethyca-fides | 已审查 | 2026-05-06 05:11 | 2026-05-14 00:26 |
| GHSA-2G9V-7MR5-FGJG CVE-2026-42300 | DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header | 严重 | Gogithub.com/l3montree-dev/devguard | 已审查 | 2026-05-06 04:58 | 2026-05-14 00:26 |
| GHSA-P3W2-64XM-833J CVE-2026-42285 | GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) | 高危 | Gogithub.com/osrg/gobgp/v4 | 已审查 | 2026-05-06 04:57 | 2026-05-09 04:42 |
| GHSA-PH6F-2CVQ-79HQ CVE-2026-42281 | MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint | 严重 | npmmagicmirror | 已审查 | 2026-05-06 04:53 | 2026-06-09 07:14 |
| GHSA-3XC2-H5R3-WV3R CVE-2026-42267 | Kimai vulnerable to formula Injection via tag names in XLSX export | 中危 | Packagistkimai/kimai | 已审查 | 2026-05-06 04:53 | 2026-05-15 04:31 |
| GHSA-37W4-HWHX-4RC4 CVE-2026-42266 | JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request | 高危 | PyPIjupyterlab | 已审查 | 2026-05-06 04:53 | 2026-06-09 04:15 |
| GHSA-V228-72C7-FX8J CVE-2026-42260 | open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname` | 高危 | npmopen-websearch | 已审查 | 2026-05-06 04:51 | 2026-05-14 00:24 |
| GHSA-7JRR-XW9C-MJ39 CVE-2026-42220 | Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback | 中危 | Gogithub.com/0xJacky/Nginx-UI | 已审查 | 2026-05-06 04:49 | 2026-07-21 21:51 |
| GHSA-8RQ5-WWPP-FMJ2 CVE-2026-43939 | YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers | 高危 | NuGetYAFNET.Core | 已审查 | 2026-05-06 04:32 | 2026-05-14 00:24 |
| GHSA-XHW7-J96H-C3G5 CVE-2026-43937 | YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql` | 高危 | NuGetYAFNET.Core | 已审查 | 2026-05-06 04:32 | 2026-05-14 00:24 |
| GHSA-33GV-FC78-QGF5 CVE-2026-43938 | YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header | 高危 | NuGetYAFNET.Core | 已审查 | 2026-05-06 04:31 | 2026-05-14 00:24 |
| GHSA-JPQ4-7FMQ-Q5FJ CVE-2026-43930 | parse-server: MFA SMS one-time password accepted twice under concurrent login | 低危 | npmparse-server | 已审查 | 2026-05-06 04:30 | 2026-05-14 00:24 |
| GHSA-J4RJ-2JR5-M439 CVE-2026-43929 | ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs | 高危 | npmssrfcheck | 已审查 | 2026-05-06 04:29 | 2026-05-14 00:26 |
| GHSA-P4HC-9PJH-55C8 CVE-2025-8267 | ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid | 高危 | npmssrfcheck | 已审查 | 2026-05-06 04:29 | 2026-05-06 04:29 |