No description provided
CVE-2026-79883
No description provided
2026-10-23 归档
今日共收录 1236 条安全情报，包含 262 个 CVE，575 篇安全通告，以及 100 篇研究论文。
← 返回归档列表No description provided
CVE-2026-79879
No description provided
No description provided
CVE-2026-79880
No description provided
No description provided
CVE-2026-79881
No description provided
No description provided
CVE-2026-79878
No description provided
virtualenv: Generated files can follow existing destination links
CVE-2026-113721
## Summary Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environm
Nuxt server islands render `useHeadSafe` input without sanitisation
CVE-2026-114133
## Impact `useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is l
pypdf: Possible long runtimes/large memory usage when retrieving form fields
CVE-2026-113789
### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtim
pypdf: Possible large memory usage when parsing arrays and dictionaries
CVE-2026-113790
### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires par
pypdf: Possible large memory usage when parsing content streams
CVE-2026-113791
### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires par
Electron: SameSite cookie restrictions are not applied to windows opened from links
CVE-2026-113796
### Impact Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
CVE-2026-113797
### Impact `chrome.tabs.query()` returned each tab's `url` and `title` to extensions that held neither the `tabs` permis
Electron: Frame subscription trusts GPU-supplied frame geometry
CVE-2026-114122
### Impact Frame data received from the GPU process for `webContents.beginFrameSubscription` was not fully validated by
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
CVE-2026-114124
### Impact In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the
Electron: openExternal permission requests can be attributed to the wrong origin
CVE-2026-114121
### Impact Requests to open external protocol URLs could be attributed to a document other than the one that asked for t
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
CVE-2026-114145
### Summary `create_submodule(name, path, url)` clones a submodule into the repo's own `.git` directory before it reje
fastify is vulnerable to header validation bypass via case-sensitive propertyNames
CVE-2026-107832
### Impact Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request hea
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
CVE-2026-114142
### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
CVE-2026-114143
## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted ke
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
CVE-2026-114144
### Summary `toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first boundin