Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
CVE-2026-46627
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, m
2026-07-16 归档
今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。
← 返回归档列表Twig: PHP code injection via `{% use %}` template name
CVE-2026-46633
Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template n
Twig: Sandbox property and method bypass via object-destructuring assignment
CVE-2026-46639
Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::g
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
CVE-2026-46635
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), whic
Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
CVE-2026-47732
Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a
mastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal
CVE-2026-15749
A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function e
Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve
CVE-2026-49476
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser
Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser
CVE-2026-49477
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser
symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
CVE-2026-46644
Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 unti
tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
CVE-2026-49855
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routin
Tornado: Out-of-bounds memory access in C extension
CVE-2026-49854
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tor
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
CVE-2026-49853
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-cop
sigstore-js: Insufficient Verification of Data Authenticity
CVE-2026-48816
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify deriv
sigstore-js: DSSE payloadType type-binding failure
CVE-2026-48758
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding fu
sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
CVE-2026-48815
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certifi
decompress: Archive extraction can create files and links outside the target directory
CVE-2026-53486
The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files an
linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
CVE-2026-48801
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the pack
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
CVE-2026-49978
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE san
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
CVE-2026-49459
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(roo
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
CVE-2026-49458
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(nod