urllib3: Chunked Deflate streaming can enter an infinite loop
CVE-2026-97688
urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked
2026-09-30 归档
今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
CVE-2026-54872
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves
Excessive Memory Allocation in Relative CRLDP Processing
CVE-2026-35189
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap grow
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
CVE-2026-102601
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/W
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
CVE-2026-102600
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-eng
GluonTS arbitrary command execution during model deserialization
CVE-2026-100308
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dep
Nicotine+: Decompression of peer messages can exhaust available memory
CVE-2026-68911
Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client
Integer Overflow or Wraparound and Out-of-bounds Write in compress
CVE-2026-63209
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2
Weblate: Mercurial argument injection via repository filenames allows authenticated command execution
CVE-2026-86035
Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 202
Webmin: Reflected XSS in the Configuration module
CVE-2026-49243
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click o
ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
CVE-2026-102570
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function
ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter
CVE-2026-102569
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit functio
Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py
CVE-2026-102568
Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows
CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization
CVE-2026-102567
CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing
CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin
CVE-2026-102566
CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload
lib0 `readFromDataView` out-of-bounds read
CVE-2026-102521
The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer.
lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory
CVE-2026-102360
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, le
Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox
CVE-2026-82973
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a r
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix
CVE-2026-102437
OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasoni
KVM: x86/mmu: Check write tracking in all address spaces
CVE-2026-98164
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address s