axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit...
CVE-2026-67318
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bo
2026-08-02 归档
今日共收录 946 条安全情报，包含 146 个 CVE，466 篇安全通告，以及 75 篇研究论文。
← 返回归档列表axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing...
CVE-2026-67313
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names wi
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction...
CVE-2026-67316
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype h
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST...
CVE-2026-67311
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fail
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that...
CVE-2026-67308
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execut
axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in...
CVE-2026-67315
axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing re
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled...
CVE-2026-67312
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream...
CVE-2026-67317
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch a
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth...
CVE-2026-67314
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/a
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters...
CVE-2026-67289
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controll
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS...
CVE-2025-71404
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable...
CVE-2026-18062
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site S
gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode
CVE-2026-54785
### Summary `consult_gemini_with_files` in **inline mode** read any file path supplied in the `files` argument without c
core-geonetwork has an Open Redirect Bypass
CVE-2026-53573
### Summary GeoNetwork's post-login redirect handling can be bypassed to redirect users to an attacker-controlled extern
sigstore-go fails to check signature timestamps against a signing key's validity period
CVE-2026-54787
sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
CVE-2026-53609
## Summary `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated e
sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes
CVE-2026-53606
## Summary sanitize-html uses `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `nau
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
CVE-2026-52887
## Summary `GET /api/myInAppChannels:list` accepts a structured `filter` query parameter. The handler for the `latestMs
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
CVE-2026-65841
A `` element placed directly inside an `` (or MathML) container was not removed by Jodit's clean-html sanitizer. The de
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
CVE-2026-58263
### Summary jodit's built-in `clean-html` sanitizer can be bypassed by a MathML/`` carrier that hides a dangerous elemen