Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that...
CVE-2026-114115
Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays wit
2026-10-21 归档
今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary...
CVE-2026-114198
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a c
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str...
CVE-2026-114116
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write...
CVE-2026-114109
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the script
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete...
CVE-2026-114110
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by suppl
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE...
CVE-2026-114111
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve...
CVE-2026-114112
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execut
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026...
CVE-2026-114113
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, C
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability...
CVE-2026-114107
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attack
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the...
CVE-2026-114103
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard b
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that...
CVE-2026-114095
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause in
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that...
CVE-2026-114098
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to writ
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows...
CVE-2026-114104
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content val
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated...
CVE-2026-114102
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows...
CVE-2026-114106
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout...
CVE-2026-114096
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allo
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which...
CVE-2026-114101
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 f
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows...
CVE-2026-114105
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setg
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter...
CVE-2026-114097
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allo
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on...
CVE-2026-114094
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrar