n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy

CVE-2026-86996

## Impact A workflow's "_This workflow can be called by_" setting was enforced by the Execute Workflow node but was not

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to Denial of Service via crafted multipart field names

CVE-2026-77078

### Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a sing

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

CVE-2026-77037

### Impact A vulnerability in multer `2.2.0` allows an attacker to trigger a Denial of Service (DoS) by aborting or tru

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to file size limit bypass via async fileFilter race condition

CVE-2026-77063

### Impact When `multer` is configured with an asynchronous `fileFilter`, the `limits.fileSize` limit can be bypassed.

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to Denial of Service via oversized array index in field names

CVE-2026-82333

### Impact multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `a

历史摘要 · 未重新核验 · GitHub Advisory

morgan vulnerable to Log Forging via unescaped Unicode line separators

CVE-2026-15603

### Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutrali

历史摘要 · 未重新核验 · GitHub Advisory

mongodb: Reject "." and NUL bytes in database and collection names

CVE-2026-81525

### Impact Passing untrusted input as part of a database or collection name may result in targeting a different database

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

CVE-2026-84376

## Summary Astro stripped a configured `base` path from request pathnames using a string-prefix check that did not veri

历史摘要 · 未重新核验 · GitHub Advisory

Composer arbitrary command execution via a malicious package's Perforce source URL

CVE-2026-84361

## Summary If the `p4` Perforce CLI client is installed, a malicious dependency package from a package repository allow

历史摘要 · 未重新核验 · GitHub Advisory

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

CVE-2026-84375

## Summary `maxTotalMergeKeys` does not count empty mappings. An attacker can repeatedly merge a large sequence of them

历史摘要 · 未重新核验 · GitHub Advisory

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

CVE-2026-84308

The pure-PHP X25519 scalar multiplication in phpseclib is not constant-time. Field addition and subtraction each perform

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

CVE-2026-84365

### Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. `toSSG()` can still write file

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

CVE-2026-84364

### Summary When `parseBody()` expands dot-separated form field names into nested objects, it does not limit the nestin

历史摘要 · 未重新核验 · GitHub Advisory

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

CVE-2026-83617

## Summary An embedded line terminator bypasses the `requireWellFormed` serializer check for element and attribute name

历史摘要 · 未重新核验 · GitHub Advisory

xmldom: DocType `name` Injection Bypasses requireWellFormed

CVE-2026-83608

## Summary The `@xmldom/xmldom` serializer emits `DocumentType.name` verbatim into the `` declaration with no well-form

历史摘要 · 未重新核验 · GitHub Advisory

Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics

在多机器人协作系统中，任务交接通常依赖下游验证器对机器人上报的传感器遥测数据进行远程证明，以确保物理行为与所分配任务严格一致。然而，论文作者对该信任链提出了质疑：这些遥测数据本身是否可信？本文揭示了一个存在于 Robot Operating

历史摘要 · 未重新核验 · arXiv cs.CR

One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability

本研究针对软件漏洞修复中的一个盲点展开：一个漏洞往往并非由一个安全补丁（SP）就能彻底解决，而是可能通过多个补丁增量修复、跨维护分支传播或在相关代码库中复制完成。由于现有漏洞数据库通常只记录部分补丁，下游用户可能只应用了部分修复，导致漏洞未

历史摘要 · 未重新核验 · arXiv cs.CR

Grid Trouble in Paradise: Uncovering Vulnerable Distributed Energy Resources and Their Grid-Level Risks

随着太阳能分布式能源资源(DER)在全球的大规模部署，其网络暴露面与潜在电网风险日益凸显。本文针对联网太阳能DER基础设施，开展了互联网规模的暴露评估与漏洞分析。作者首先提出了一种从互联网扫描数据中精准识别太阳能DER的方法，成功发现超过6

历史摘要 · 未重新核验 · arXiv cs.CR

Creation of temporary file in directory with insecure permissions in Windows Error Reporting allows an authorized attacker to perform tampering locally.

CVE-2026-69482

CVE-2026-69482 涉及 Windows 错误报告 (Windows Error Reporting, WER) 组件在创建临时文件时使用了不安全权限的目录。该缺陷允许具备本地访问权限的授权攻击者对这些临时文件执行篡改操作，从而可

历史摘要 · 未重新核验 · NVD

Heap-based buffer overflow in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.

CVE-2026-69481

该漏洞通报来源于 NVD，仅提供简短的描述信息，未包含受影响产品、厂商补丁链接或详细技术分析。根据元数据，CVE-2026-69481 是 Windows 企业应用管理（Windows Enterprise App Management）组

历史摘要 · 未重新核验 · NVD