浏览报告
15,219 份报告 · 本页赏金 $200
CVE-2026-111483: GnuTLS accepts non-successful OCSP staples密码学缺陷curl低危—2026-10-26Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests信息泄露curl低危—2026-10-17libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request其他弱点curl低危—2026-10-17CVE-2026-111481: server-set cookie still aborts cookie jar其他弱点curl低危—2026-10-26CVE-2026-111482: libssh2 knownhosts prefix match业务逻辑curl低危—2026-10-26libcurl TLS shorter-retry mismatch discloses client heap memory during cancelled IMAPS upload内存破坏curl低危—2026-10-19FTP authentication options leak to a cross-origin FTP redirect with unrestricted auth disabled身份认证curl低危—2026-10-26TFTP accepts a first response from an IP other than the requested server密码学缺陷curl低危—2026-10-16CVE-2026-111480: pause UAF from within callback内存破坏curl低危—2026-10-26CVE-2026-107929: local interface connection reuse mixup信息泄露curl低危—2026-10-14CVE-2026-107928: info leak uploading over WebSockets with GnuTLS内存破坏curl低危—2026-10-14HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)注入与走私curl低危—2026-10-15Cookie attribute truncation in curl drops Secure/HttpOnly protections信息泄露curl低危—2026-10-08CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matching拒绝服务Weblate低危—2026-11-05Rustls backend discloses out-of-bounds heap data during legal IMAP upload cancellation内存破坏curl低危—2026-10-05ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754跨站脚本Ruby on Rails低危—2026-10-10Unescaped consent-prompt renderer (HTML()) enables concealed-approval OS command injection in strands-agents/tools use_computer — RCE代码执行AWS VDP低危—2026-11-06libcurl: Secure=1 cookie flag bypasses the 8.22.0 fix and leaks over HTTP信息泄露curl低危—2026-10-06HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks身份认证HackerOne低危$2002026-10-08Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor data身份认证Essity低危—2026-10-14Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade信息泄露curl中危—2026-10-05curl tool: --hsts is ignored for a schemeless URL starting with a slash under --proto-default http密码学缺陷curl低危—2026-10-08`Vary` cache-key conflation of absent and empty request fields其他弱点Django低危—2026-11-03IMAP literal size truncation on 32-bit platforms corrupts downloads and desynchronizes the response parser其他弱点curl中危—2026-10-05[HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames路径遍历curl中危—2026-09-26