Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist
CVE-2026-42590
**Summary** The ExifTool metadata write blocklist in Gotenberg v8 can be bypassed using ExifTool's group-prefix syntax,
2026-05-07 归档
今日共收录 722 条安全情报，包含 0 个 CVE，380 篇安全通告，以及 58 篇研究论文。
← 返回归档列表Netty has HttpClientCodec response desynchronization
CVE-2026-42584
### Summary If HttpClientCodec is configured, there are use cases when a response body from one request, can be parsed
Netty HTTP/3 QPACK literal unbounded allocation
CVE-2026-42582
### Summary When Netty decodes HTTP/3 headers, it sometimes runs `new byte[length]` using a length from the wire before
Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing
CVE-2026-42580
### Summary Netty's chunk size parser silently overflows int, enabling request smuggling attacks. ### Details io.netty.
Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)
CVE-2026-42579
# Security Vulnerability Report: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) ## 1. Vulnerability Sum
wasmtime has a panic when allocating a table exceeding the size of the host's address space
CVE-2026-44216
### Impact Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow.
Vercel: Non-interactive mode includes CLI arguments in suggested command output
CVE-2026-44479
# Summary When the Vercel CLI runs in non-interactive mode (`--non-interactive` or auto-detected AI agent), commands th
Weblate vulnerable to XSS via crafted Markdown
CVE-2026-44264
### Impact The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some att
gix-fs: Symlink prefix-reuse allows worktree escape during checkout
CVE-2026-44471
### Summary A malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-c
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
CVE-2026-44456
## Summary `bodyLimit()` does not reliably enforce `maxSize` for requests without a usable `Content-Length` (e.g. `Tran
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection
CVE-2026-44455
## Summary Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted
ShellHub has crash-DoS via field injection in filter and sort-by parameters
CVE-2026-44425
## Summary The device list endpoint accepts user-controlled identifiers in two places that are passed directly as BSON/S
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...
京公网安备 11000002002063号
输入内容为公安备案号，并非威胁情报文章，无法提取任何威胁信息。可能为录入错误或非预期内容。
（总）网出证（京）字第281号
本次输入未提供有效的威胁情报内容。标题和来源指向360网站备案信息，而非安全报告。摘要为空，无任何技术细节、攻击活动或漏洞信息。无法生成有意义的分析。
京网文〔2020〕6051-1195号
该输入内容为版权声明（京网文〔2020〕6051-1195号），源自360CERT安全报告页面，但实际内容并非威胁情报报告，无任何攻击活动、漏洞或威胁信息。标签包含report、apt、malware、360，但无法确认其关联性。由于原文摘
京ICP证080047号[京ICP备08010314号-6]
输入内容为空，无法生成有效的情报摘要。原文标题为备案号信息，来源为360CERT安全报告，但未提供任何事件描述或技术细节。仅包含标签：report, apt, malware, 360，暗示可能与APT攻击或恶意软件相关，但缺乏具体内容。
CrowdStrike Falcon Platform Achieves 441% ROI in Three Years
CrowdStrike Falcon Platform Achieves 441% ROI in Three Years
Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019
Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019
Cloud ManagerManage your cloud resources
Cloud ManagerManage your cloud resources