fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
CVE-2026-110306
### Impact `fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so
2026-10-24 归档
今日共收录 814 条安全情报，包含 0 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表fast-uri vulnerable to improper path equivalence in relative reference normalization
CVE-2026-110095
### Impact `fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to t
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110180
### Impact `fast-uri` versions `>= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family U
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
CVE-2026-110725
### Impact `fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `referen
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language...
CVE-2026-113877
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regul
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-57849
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of...
CVE-2026-115796
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Manag
A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the...
CVE-2026-115797
A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in...
CVE-2026-115845
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allo
A potential security vulnerability has been identified in HP One Agent for certain HP PC products...
CVE-2026-91093
A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for
SvelteKit: URL redirection to untrusted site via enhanced form submission
CVE-2026-114060
### Impact Applications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, suc
pypdf: Possible long runtimes for repeated references to the same missing object
CVE-2026-115572
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
CVE-2026-115585
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-re
pypdf: Possible long runtimes for large xref table header limits
CVE-2026-115580
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening
Tokio: Race condition in `tokio::time::Interval`
CVE-2026-115567
### Summary On the multi-threaded runtime, there is a race condition between `Interval::poll_tick` and the runtime's ti
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
CVE-2026-111181
### Impact A single request can crash any application using `body-parser` with default options. When a request carries
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
CVE-2026-115419
**Summary** Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-a
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
CVE-2026-115586
## Summary The bash activator puts the caller-supplied prompt value into `PS1` unescaped whenever `promptvars` is off a
Mistune: Path Traversal and XSS in Include directive
CVE-2026-115355
The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
CVE-2026-115774
## Summary An infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the