检索 GitHub Advisory Database 中的已审查与未审查安全公告。
| 公告编号 | 摘要 | 级别 | 生态 / 软件包 | 审查状态 | 发布时间 | 修改时间 |
|---|---|---|---|---|---|---|
| GHSA-V82C-5C2Q-HX9G | Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName 已撤回 | 中危 | Gogithub.com/grafana/grafana-operator | 已审查 | 2026-06-13 14:30 | 2026-06-20 04:50 |
当前筛选结果 998 条 · 时间按北京时间显示
| GHSA-CHQM-WXM2-W73W |
Duplicate Advisory: OpenClaw: Mattermost handlers could fall open when channel type was missing 已撤回 |
| 中危 |
npmopenclaw |
| 已审查 |
| 2026-06-13 08:34 |
| 2026-08-28 23:53 |
| GHSA-C85P-9PVR-F7F5 | Duplicate Advisory: OpenClaw: Node pairing reconnection could confuse approval scope state 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-06-13 08:34 | 2026-08-26 00:39 |
| GHSA-R27J-FXMQ-RG2Q | Duplicate Advisory: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-06-13 08:34 | 2026-08-28 05:56 |
| GHSA-P68J-Q8J9-JWF5 | Duplicate Advisory: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload 已撤回 | 中危 | npmopenclaw | 已审查 | 2026-06-13 08:34 | 2026-08-25 05:05 |
| GHSA-GWCQ-453V-2FRR | Duplicate Advisory: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-06-13 08:34 | 2026-08-26 00:38 |
| GHSA-FFHM-8FWQ-7Q27 | Duplicate Advisory: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-06-13 08:34 | 2026-08-26 00:39 |
| GHSA-3QG8-HQ7J-JJ33 | Duplicate Advisory: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-06-13 08:34 | 2026-08-28 23:55 |
| GHSA-35C7-4R45-9GV3 | Duplicate Advisory: OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-06-13 08:34 | 2026-08-28 23:55 |
| GHSA-GV7W-RQVM-QJHR | Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY 已撤回 | 高危 | npmesbuild | 已审查 | 2026-06-13 04:08 | 2026-06-17 21:42 |
| GHSA-V42X-X7JP-845H CVE-2026-6657 | Duplicate Advisory: jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used 已撤回 | 中危 | PyPIjupyter-server | 已审查 | 2026-06-04 02:33 | 2026-08-01 04:25 |
| GHSA-GF7Q-Q4J7-HP7C CVE-2026-5422 | Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path() 已撤回 | 中危 | PyPIjupyter-server | 已审查 | 2026-06-02 20:31 | 2026-08-01 04:20 |
| GHSA-HX4V-668P-G2QR | Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity 已撤回 | 高危 | npmopenclaw | 已审查 | 2026-05-30 02:31 | 2026-07-03 04:50 |
| GHSA-8HCX-P7M8-GC28 | Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement 已撤回 | 高危 | Mavenorg.keycloak:keycloak-services | 已审查 | 2026-05-28 14:31 | 2026-07-02 05:20 |
| GHSA-M4F9-C775-WG56 | Duplicate Advisory: gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules 已撤回 | 高危 | crates.iogix | 已审查 | 2026-05-26 23:32 | 2026-07-01 01:40 |
| GHSA-76V6-F83Q-PXVH | Duplicate Advisory: Hackney has an Allocation of Resources Without Limits or Throttling vulnerabilit 已撤回 | 高危 | Hexhackney | 已审查 | 2026-05-26 21:30 | 2026-07-01 01:15 |
| GHSA-WJ3Q-VW2V-3RJ3 | Duplicate Advisory: phpMyFAQ: SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS 已撤回 | 中危 | PackagistphpMyFAQ/phpMyFAQ+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:03 |
| GHSA-W9MJ-GFRM-HJ5X | Duplicate Advisory: phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check 已撤回 | 高危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:01 |
| GHSA-W42G-JJ8W-FJ77 | Duplicate Advisory: phpMyFAQ: Stored XSS via Utils::parseUrl() in comment rendering 已撤回 | 高危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 07:58 |
| GHSA-RMQR-H98C-QG2M | Duplicate Advisory: phpMyFAQ: Path traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins 已撤回 | 高危 | PackagistphpMyFAQ/phpMyFAQ | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:00 |
| GHSA-P9WC-4PJV-RG82 | Duplicate Advisory: phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields 已撤回 | 高危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:02 |
| GHSA-P26V-FX3X-R2RP | Duplicate Advisory: phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User 已撤回 | 中危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:03 |
| GHSA-H36G-93QX-RXGR | Duplicate Advisory: phpMyFAQ: Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization 已撤回 | 中危 | PackagistphpMyFAQ/phpMyFAQ+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 08:00 |
| GHSA-CQRW-J4QC-7F9W | Duplicate Advisory: phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query 已撤回 | 高危 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 07:59 |
| GHSA-CH9Q-C9MP-J5GQ | Duplicate Advisory: phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha 已撤回 | 严重 | Packagistphpmyfaq/phpmyfaq+1 | 已审查 | 2026-05-16 05:31 | 2026-06-09 07:57 |