A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3....
CVE-2026-16630
A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the funct
2026-07-23 归档
今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。
← 返回归档列表An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate...
CVE-2026-38765
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kerne
A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger...
CVE-2026-16629
A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
CVE-2026-64645
## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled in
Next.js: Denial of Service in the Image Optimization API using SVGs
CVE-2026-64644
### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely ho
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
CVE-2024-7708
### Impact The original report: > Server handling of 100-Continue requests can lead to memory leak that can be abused t
Eclipse Jetty: Path parameter traversal
CVE-2026-8384
### Description (as reported) #### Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath() may leave d
Eclipse Jetty: HTTP Authority/Host mismatch
CVE-2026-6790
#### Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :au
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
CVE-2026-10051
### Description > FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers) > HttpConnection._trailers Cross-Req
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
CVE-2026-10050
### Summary The `DigestAuthentication.apply()` method in Jetty's HTTP client uses `getBytes(StandardCharsets.ISO_8859_1)
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
CVE-2026-65589
## Impact Custom HTTP headers configured in credentials for certain LLM sub-nodes (including OpenAI, Anthropic, and Lemo
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
CVE-2026-59943
### Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG render
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
CVE-2026-59942
### Summary Dompdf v3.1.5 is vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can cra
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
CVE-2026-59941
### Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its *declared* header dimension
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
CVE-2026-59821
### Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and valida
LiteLLM: Local file read via request-supplied OIDC file references
CVE-2026-59819
### Impact LiteLLM's `/health/test_connection` endpoint resolved request-supplied environment and OIDC file references
n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
CVE-2026-65596
## Impact The GraphQL node did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (suc
n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
CVE-2026-65594
## Impact The OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0 does not verify that the authenticated
n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads
CVE-2026-58661
## Impact An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request
n8n: External Secrets Accessible via Workflow Expressions Outside Credentials
CVE-2026-59254
## Impact External secrets were incorrectly resolved in workflow node expressions, where they are not intended to be ava