morgan vulnerable to Log Forging via unescaped Unicode line separators

CVE-2026-15603

### Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutrali

历史摘要 · 未重新核验 · GitHub Advisory

Windows ML CLI: CORS misconfig enables localhost RCE

CVE-2026-84452

Case Description: MSRC Notes: Attachments: 1 file(s) attached (1 mp4) Summary: The vulnerability lies in the 'serve/cli

历史摘要 · 未重新核验 · GitHub Advisory

mongodb: Reject "." and NUL bytes in database and collection names

CVE-2026-81525

### Impact Passing untrusted input as part of a database or collection name may result in targeting a different database

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Remote code execution through AVIF image optimization

A vulnerability in `libheif`, used by the default Sharp image service in Astro, can lead to remote code execution when a

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

CVE-2026-84376

## Summary Astro stripped a configured `base` path from request pathnames using a string-prefix check that did not veri

历史摘要 · 未重新核验 · GitHub Advisory

Composer arbitrary command execution via a malicious package's Perforce source URL

CVE-2026-84361

## Summary If the `p4` Perforce CLI client is installed, a malicious dependency package from a package repository allow

历史摘要 · 未重新核验 · GitHub Advisory

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

### Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in

历史摘要 · 未重新核验 · GitHub Advisory

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

CVE-2026-84375

## Summary `maxTotalMergeKeys` does not count empty mappings. An attacker can repeatedly merge a large sequence of them

历史摘要 · 未重新核验 · GitHub Advisory

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

CVE-2026-84308

The pure-PHP X25519 scalar multiplication in phpseclib is not constant-time. Field addition and subtraction each perform

历史摘要 · 未重新核验 · GitHub Advisory

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

## Summary `@tiptap/core` contains two quadratic regular-expression denial-of-service paths in its default Markdown att

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

CVE-2026-84365

### Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. `toSSG()` can still write file

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

CVE-2026-84364

### Summary When `parseBody()` expands dot-separated form field names into nested objects, it does not limit the nestin

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

CVE-2026-84363

### Summary Hono's query parsing does not stop at the URL fragment: a `?` appearing after a `#` is treated as the start

历史摘要 · 未重新核验 · GitHub Advisory

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

CVE-2026-84445

A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:a

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead t

历史摘要 · 未重新核验 · GitHub Advisory

SVGO: removeScripts allows executable links through namespace and control-character bypasses

CVE-2026-84370

## Summary SVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors

历史摘要 · 未重新核验 · GitHub Advisory

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

CVE-2026-84369

## Summary SVGO's opt-in `removeScripts` plugin did not inspect executable HTML content inside SVG `` elements. Applica

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

### Summary Nodemailer's `disableFileAccess` / `disableUrlAccess` options are a security sandbox that lets an applicati

历史摘要 · 未重新核验 · GitHub Advisory

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

CVE-2026-83616

## Summary `Document.createProcessingInstruction()` in `@xmldom/xmldom` performs no validation on the `target` paramete

历史摘要 · 未重新核验 · GitHub Advisory

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

CVE-2026-83617

## Summary An embedded line terminator bypasses the `requireWellFormed` serializer check for element and attribute name

历史摘要 · 未重新核验 · GitHub Advisory