A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by...
CVE-2026-101098
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the funct
#advisory
共收录 23312 条相关情报。
← 返回所有主题Bluehood: Missing authentication on Bluehood API routes when web auth is enabled
CVE-2026-49994
Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML
ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
CVE-2026-101913
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
CVE-2026-55156
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge gra
Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
CVE-2026-55157
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge gra
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside...
CVE-2026-101912
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSub
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
CVE-2026-101911
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address
ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
CVE-2026-101910
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, th
Axios: Prototype Pollution Gadget in axios toFormData Options
CVE-2026-101909
Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFo
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
CVE-2026-101908
Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
CVE-2026-101907
Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses t
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
CVE-2026-101906
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy appl
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
CVE-2026-101905
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib
Axios: Header Injection via Inherited headers After Minimal Interceptor
CVE-2026-101904
Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
CVE-2026-101903
Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular express
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
CVE-2026-101902
Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-ins
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
CVE-2026-101901
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not insta
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
CVE-2026-101900
Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherite
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
CVE-2026-101898
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup d
@xhmikosr/decompress: Path traversal via symlink chain
CVE-2026-101894
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output)