Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

CVE-2026-71850

### Summary `memo()` from `hono/jsx` retains the result of a server-side render and reuses it for later renders with co

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Proxy Helper does not remove response headers listed in the `Connection` header

CVE-2026-71849

### Summary The Proxy Helper (`hono/proxy`) does not remove response headers named by the origin's `Connection` header.

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Algorithmic Complexity DoS in Language Middleware

CVE-2026-71848

### Summary The `languageDetector` middleware is vulnerable to algorithmic complexity denial of service when processing

历史摘要 · 未重新核验 · GitHub Advisory

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

CVE-2026-71847

### Summary Ruby's JSON native C extension clears the consumed `JSON::ResumableParser` input buffer but leaves `state.s

历史摘要 · 未重新核验 · GitHub Advisory

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CVE-2026-63222

### Impact In affected versions, calling `UploadedFile::move()` **without a second argument** uses the client-provided f

历史摘要 · 未重新核验 · GitHub Advisory

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

CVE-2026-63220

### Impact `IncomingRequest::isSecure()` trusted the `X-Forwarded-Proto` and `Front-End-Https` headers from any incoming

历史摘要 · 未重新核验 · GitHub Advisory

jsii-diff: Command Injection via npm: package argument

CVE-2026-15895

## Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report erro

历史摘要 · 未重新核验 · GitHub Advisory

Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

CVE-2026-56818

## Summary `RedisArrayAggregator` clears retained partial aggregate state when the `maxNestedArrayDepth` limit is excee

历史摘要 · 未重新核验 · GitHub Advisory

SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

CVE-2026-66062

### Impact SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The i

历史摘要 · 未重新核验 · GitHub Advisory

go-git: Malicious reference names may modify files outside the reference storage

CVE-2026-71557

### Impact A path traversal issue in `go-git` could allow malicious reference names to access files outside the reposito

历史摘要 · 未重新核验 · GitHub Advisory

go-git: Worktree operations may follow symlinks

CVE-2026-71556

## Impact A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended wo

历史摘要 · 未重新核验 · GitHub Advisory

Smarty Security stream restriction bypass through stream: resource

CVE-2026-62996

`smarty/smarty` version `5.8.0` can read local files through PHP stream wrappers even when Smarty Security is enabled an

历史摘要 · 未重新核验 · GitHub Advisory

Smarty: Symlink path traversal out of trusted directories

CVE-2026-62992

When Smarty's Security policy is enabled, secure_dir (and the configured template/trusted directories) restrict which lo

历史摘要 · 未重新核验 · GitHub Advisory

Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。

Paper专业的技术文章，安全经验的积累。Paper 栏目专注于安全技术文章的收录。我们推崇黑客精神，技术分享和热衷解决问题及超越极限，Seebug Paper 期待您的分享。

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Cookie settings

Cookie settings

历史摘要 · 未重新核验 · Mozilla Security Advisories

Mozilla Monitor

Mozilla Monitor

历史摘要 · 未重新核验 · Mozilla Security Advisories

The Mozilla Manifesto

The Mozilla Manifesto

历史摘要 · 未重新核验 · Mozilla Security Advisories

Mozilla Foundation

Mozilla Foundation

历史摘要 · 未重新核验 · Mozilla Security Advisories

Accessibility Policy

Accessibility Policy

历史摘要 · 未重新核验 · Oracle Critical Patch Updates

Create an Account

Create an Account

历史摘要 · 未重新核验 · Oracle Critical Patch Updates