POJIA破甲
查找接入 AI模型控制台
地图 / 漏洞目录

漏洞目录

15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。

15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金

筛选结果 1,292 份 · 本页赏金 $8,500 · 清除筛选

漏洞类别

弱点目录

主要厂商目录 · 16

最新报告

  1. CVE-2026-115529: Schannel TLS auto client session resumptioncurl · 身份认证 · 2026-10-26 · CVE-2026-115529
    无赏金低危
  2. SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connectionscurl · 身份认证 · 2026-10-19 · CVE-2022-27782
    无赏金低危
  3. netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections)curl · 身份认证 · 2026-10-26
    无赏金低危
  4. CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Authcurl · 身份认证 · 2026-10-20 · CVE-2026-3784
    无赏金低危
  5. curl RTSP connection reuse routes response headers to the RTP callback (rtsp_conn state machine not reset between sessions)curl · 身份认证 · 2026-10-19
    无赏金中危
  6. FTP authentication options leak to a cross-origin FTP redirect with unrestricted auth disabledcurl · 身份认证 · 2026-10-26
    无赏金低危
  7. HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocksHackerOne · 身份认证 · 2026-10-08
    $200低危
  8. Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor dataEssity · 身份认证 · 2026-10-14
    无赏金低危
  9. curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status linecurl · 身份认证 · 2026-10-19
    无赏金中危
  10. CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated contentWordPress · 身份认证 · 2026-10-30
    无赏金低危
  11. TLS session resumption client cert bypass with CURLOPT_SSL_CTX_FUNCTIONcurl · 身份认证 · 2026-09-14 · CVE-2016-5419
    无赏金低危
  12. HackerOne Code sends live password-reset tokens to Segment in automatic page eventsHackerOne · 身份认证 · 2026-09-24
    $200低危
  13. A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disableMozilla · 身份认证 · 2026-10-26
    $4,000中危
  14. Full Admin Takeover of R3 Limited's JFrog Artifactory - 292 Users, Corda Enterprise & CBDC Supply Chain CompromisedR3 · 身份认证 · 2026-10-08 · CVE-2026-82329
    无赏金高危
  15. Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhookBasecamp · 身份认证 · 2026-10-30
    无赏金中危
  16. CVE-2026-86411: FTP connection reuse inherits client-certificatecurl · 身份认证 · 2026-10-14 · CVE-2016-5420
    无赏金未评级
  17. 11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes firstcurl · 身份认证 · 2026-09-07
    无赏金未评级
  18. Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB authenticationPortSwigger Web Security · 身份认证 · 2026-10-15 · CVE-2021-29416
    $1,000低危
  19. 12: SASL DIGEST-MD5 does not validate the server's `rspauth` proofcurl · 身份认证 · 2026-09-10
    无赏金未评级
  20. CVE-2026-87861: cross-origin reuse of a Negotiate connectioncurl · 身份认证 · 2026-10-14 · CVE-2026-87861
    无赏金低危
  21. Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open RedirectAWS VDP · 身份认证 · 2026-10-16
    无赏金低危
  22. launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp APIBasecamp · 身份认证 · 2026-10-30
    无赏金中危
  23. Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadataShopify · 身份认证 · 2026-11-03
    $3,100低危
  24. Windows SSPI connection-pool probe can reuse a connection under the wrong usercurl · 身份认证 · 2026-10-26
    无赏金低危
  25. Windows SSPI connection-pool probe can reuse a connection under the wrong usercurl · 身份认证 · 2026-08-14
    无赏金低危
第 1 / 52 页下一页 →