Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
CVE-2026-59723
### Summary The Cline Hub dashboard server (`@cline/cline-hub`), launched via the `cline dashboard` CLI command, accept
#advisory
共收录 23334 条相关情报。
← 返回所有主题zbateson/mail-mime-parser has CRLF header injection via attachment filename
CVE-2026-61815
### Impact A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to b
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
CVE-2026-61816
### Impact An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that p
hpack: Unbounded variable integer decoding can cause run-away computation on malformed input
CVE-2026-59980
### Impact Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
CVE-2026-61782
### Summary The default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interface
Podman: Malformed Image can trick podman run into leaking host environment variables into the container
CVE-2026-57231
## Summary An container image that contains a environment variable with just a key and no value can trick podman into p
Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
CVE-2026-56742
### Impact In Cilium clusters using [Gateway API](https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gate
@bytebase/dbhub's read-only mode does not prevent database writes
CVE-2026-61788
### Summary Setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
CVE-2026-61742
### Summary DBHub `0.21.2` exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport
http4s-scala-xml has an XML External Entity (XXE) processing issue
CVE-2026-61741
http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. These decoders use
xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
CVE-2026-61784
xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString()
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
CVE-2026-56744
Reported by @echennells (Eric Chennells). Migrated from public issue #191 to a private advisory. **Affected:** `@bsv/wa
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
CVE-2026-56738
## Summary The `StopWords::add()` method in phpMyFAQ builds a SQL `INSERT` statement using `sprintf()` and inserts the
phpMyFAQ's two-factor authentication login bypasses the password factor
CVE-2026-56737
### Summary The public two-factor verification endpoint `POST /check` logs a user in based **solely** on a valid 6-digit
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
CVE-2026-56736
### Summary A stored cross-site scripting (XSS) vulnerability in phpMyFAQ allows any unauthenticated user (or low-privil
langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
## Summary `langchain-nvidia-ai-endpoints` versions before 1.4.2 accepted local filesystem paths as image inputs for Vi
CyberChef: Prototype pollution in Series Chart operation
CVE-2026-57439
On 5 June 2026 CyberChef received a security vulnerability report from @hyuunnn detailing a vulnerability in the Series
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
CVE-2026-61604
Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
CVE-2026-61732
## Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM m
Language Servers for AWS vulnerable to arbitrary file write
CVE-2026-12958
## Summary Language Servers for AWS (the aws/language-servers project) provides the Language Server Protocol implementat