js-yaml: YAML merge-key chains can force quadratic CPU consumption
CVE-2026-59869
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend
2026-07-09 归档
今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。
← 返回归档列表js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
CVE-2026-59870
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src
ToolJet GitHub Actions comment body shell injection exposes deployment secrets
CVE-2026-54344
ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview dep
repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack
CVE-2026-59702
repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated
Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer Instances
CVE-2026-55761
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used t
CyberChef: Prototype pollution in Series Chart operation
CVE-2026-57439
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart opera
App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes
CVE-2026-49147
App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output m
App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc
CVE-2026-49146
App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ac
repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint
CVE-2026-59703
repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc
CVE-2026-49145
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up th
Frigate viewer can read logs exposing admin and camera credentials
CVE-2026-54652
Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any aut
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
CVE-2026-55873
SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables ar
Multiple Security Vulnerabilities in Terraform Provider for Snowflake Could Allow Privilege Escalation and Unauthorized Snowflake Account Takeover
CVE-2026-15067
Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection
Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization
CVE-2026-15036
A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of t
bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection
CVE-2026-15035
A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm
n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation
CVE-2026-59257
n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy My
n8n - Improper Authorization in Workflow Assignment to Folders
CVE-2026-59253
n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to f
Grav - Stored CSS Injection via Markdown Image resize() Action
CVE-2026-58657
Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the
Grav - Arbitrary File Upload via Avatar Endpoint
CVE-2026-58654
The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upl
n8n - Authorization Bypass in Public API Execution Retry Endpoint
CVE-2026-56778
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint,