Backstage catalog rules can be bypassed for URL locations using encoded path segments

CVE-2026-115923

## Summary `@backstage/plugin-catalog-backend` matches URL-type locations against `catalog.rules` location patterns usi

历史摘要 · 未重新核验 · GitHub Advisory

FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GI...

CVE-2026-118753

FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attac

来源摘录 · NVD / GitHub Advisory

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attacker...

CVE-2026-118752

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIF

来源摘录 · NVD / GitHub Advisory

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Vide...

CVE-2026-118537

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catal

来源摘录 · NVD / GitHub Advisory

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

## ⚠️ Update (verification, 2026-05-19): C-2 confirmed end-to-end — **4.5× amplification observed** (worse than the advi

历史摘要 · 未重新核验 · GitHub Advisory

Waline login accepts a non-string email as a match-all MongoDB query

## Summary The login endpoint POST /api/token reads the `email` field from the request body without checking its type a

历史摘要 · 未重新核验 · GitHub Advisory

Seroval: Code injection through a typed array's own constructor property

CVE-2026-116583

### Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in th

历史摘要 · 未重新核验 · GitHub Advisory

Seroval: Script injection through RegExp sources in serialized output

CVE-2026-116582

### Summary seroval writes a `RegExp` as a regular expression literal. In affected versions, the `` element that the se

历史摘要 · 未重新核验 · GitHub Advisory

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

CVE-2026-116581

### Summary `fromJSON` and `fromCrossJSON` used two node fields without checking them. - An array node's element list

历史摘要 · 未重新核验 · GitHub Advisory

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

CVE-2026-116584

### Summary `fromJSON` and `fromCrossJSON` did not check that an array node's element list is an array. A small crafted

历史摘要 · 未重新核验 · GitHub Advisory

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

CVE-2026-116580

### Summary When `fromJSON` rebuilt an async iterator, it called `on()` on the iterator's source without checking that

历史摘要 · 未重新核验 · GitHub Advisory

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

CVE-2026-116575

Summary _build_session_scope() in mem0/memory/main.py builds the conversation-history scope key used to fetch/store the

历史摘要 · 未重新核验 · GitHub Advisory

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native...

CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in ind

来源摘录 · NVD / GitHub Advisory

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters suc...

CVE-2026-118662

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate se

来源摘录 · NVD / GitHub Advisory

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

CVE-2026-115910

### Summary The generic OpenID Connect backend (`OpenIdConnectAuth` and every backend built on it) stores the `nonce` i

历史摘要 · 未重新核验 · GitHub Advisory

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

CVE-2026-115920

## Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than thr

历史摘要 · 未重新核验 · GitHub Advisory

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

CVE-2026-115922

## Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor d

历史摘要 · 未重新核验 · GitHub Advisory

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

CVE-2026-115921

## Summary ONNX shape inference did not safely validate the required Scan `num_scan_inputs` attribute. Two malformed va

历史摘要 · 未重新核验 · GitHub Advisory

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

CVE-2026-115919

## Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from

历史摘要 · 未重新核验 · GitHub Advisory

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

CVE-2026-115893

## Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module wi

历史摘要 · 未重新核验 · GitHub Advisory