PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification
CVE-2026-53671
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstra
2026-09-03 归档
今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。
← 返回归档列表HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
CVE-2026-84378
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src
libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
CVE-2026-82522
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers
DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN
CVE-2026-49832
DSpace open source software is a repository application which provides durable access to digital resources. From version
DSpace: Path Traversal possible in LDN message generation
CVE-2026-49833
DSpace open source software is a repository application which provides durable access to digital resources. From version
DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)
CVE-2026-49831
DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver
DSpace: ORE resource URI does not validate scheme for non-web resources
CVE-2026-49830
DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver
agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode
CVE-2026-84811
agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to
claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan
CVE-2026-84810
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md wh
Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode
CVE-2026-84809
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pyca
Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE
CVE-2026-52831
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio control
Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
CVE-2026-79756
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauth
Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)
CVE-2026-79755
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio loca
Nuclio: Kaniko build tempDir command injection
CVE-2026-79754
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
CVE-2026-52833
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runt
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
CVE-2026-52832
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard e
TOON: Prototype pollution when decoding untrusted TOON input
CVE-2026-82404
TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controll
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
CVE-2026-84376
Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path fro
async-tar PAX extension-header desync enables tar entry/content smuggling
CVE-2026-53600
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffe
Authenticated SQL Injection via nested eager-loading criteria
CVE-2026-79991
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing th