Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression...
CVE-2026-41705
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized
2026-05-10 归档
今日共收录 706 条安全情报，包含 57 个 CVE，372 篇安全通告，以及 20 篇研究论文。
← 返回归档列表An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary...
CVE-2026-6664
An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly...
CVE-2026-6665
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the conten
Hono has CSS Declaration Injection via Style Object Values in JSX SSR
CVE-2026-44458
### Summary The JSX renderer escapes `style` attribute object values for HTML but not for CSS. Untrusted input in a `st
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
CVE-2026-44459
### Summary Improper validation of the JWT NumericDate claims `exp`, `nbf`, and `iat` in `hono/utils/jwt` allows tokens
Velocity.js has a Prototype Pollution vulnerability through #set path assignment
CVE-2026-44966
### Summary A prototype pollution vulnerability was discovered in Velocity.js )[key] = val`. Because there is no valid
Vert.x has a DoS via unbounded server-side SNI SslContext cache growth
CVE-2026-6860
Potential unbounded server-side SNI `SslContext` cache growth in Vert.x TLS handling, with possible resource-exhaustion
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
CVE-2026-44457
### Summary Cache Middleware does not skip caching for responses that declare per-user variance via `Vary: Authorizatio
smallbitvec: Integer overflow in safe API leads to heap buffer overflow
CVE-2026-44983
### Summary An integer overflow in the internal capacity calculation of `smallbitvec` can lead to an undersized heap all
SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)
CVE-2026-44788
### Summary A path traversal vulnerability in `IArchive.WriteToDirectory()` allows a malicious archive to create direct
epa4all-client has a VAU Signature bypass
CVE-2026-44900
### Impact In SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the b
Mistune has XSS via unescaped figclass/figwidth in Figure directive
CVE-2026-44896
In `src/mistune/directives/image.py`, the `render_figure()` function concatenates `figclass` and `figwidth` options dire
view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
CVE-2026-44837
### Summary The system test entrypoint canonicalizes a user-controlled file path with `File.realpath`, then checks whet
view_component: Preview Route Can Dispatch Inherited Helper Methods
CVE-2026-44836
### Summary The preview route derives an example name from the URL and calls it with `public_send`. The code does not v
Snipe-IT has an open redirect vulnerability
CVE-2026-44833
Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Refer
eml_parser has recursion DoS via nested message/rfc822 attachments
CVE-2026-44844
### Summary `EmlParser.get_raw_body_text()` recurses unconditionally for every nested `message/rfc822` attachment witho
LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
CVE-2026-44843
LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled pa
Phpseclib needs guardrails on large binaryfield integers
CVE-2023-49316
### Impact Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc) ### Patch
free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types
CVE-2026-44325
### Summary free5GC's NRF root SBI endpoint `POST /oauth2/token` contains a parser-level type-confusion bug family. The
free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)
CVE-2026-44321
### Summary free5GC's SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as