knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
CVE-2026-54462
Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the
#advisory
共收录 23093 条相关情报。
← 返回所有主题qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
CVE-2026-110816
## Summary `qs.stringify(obj, { arrayFormat: 'comma' })` throws an uncaught `TypeError: Cannot convert object to primit
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
CVE-2026-109855
### Impact undici's experimental WebSocket client (enabled by default via `allowH2: true`) crashes the Node.js process
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
CVE-2026-114616
Reporter: Cavan Loughran, Celvex Group Inc. Summary Authlib's symmetric (oct) key handling accepts an empty key (empty
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
In rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the serv
rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share
## Summary The client records the server-selected key-exchange group per server name when it processes the ServerHello,
libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
CVE-2026-109089
A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious
desmondmorris node-tesseract Command Builder tesseract.js process os command injection
CVE-2026-117511
A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function proce
Host filesystem path disclosure via DNS rebinding
CVE-2026-109823
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/c
Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal
CVE-2026-117510
A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr0
3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share
CVE-2026-104189
The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file
a2aproject a2a-java TaskManager.saveTaskEvent race condition
CVE-2026-117507
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManag
a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
CVE-2026-117506
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificat
Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
CVE-2026-117604
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allo
a2aproject a2a-java ChildQueue queue.offer resource consumption
CVE-2026-117505
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction w...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing ma
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search param...
CVE-2026-116892
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenti
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unesca...
CVE-2026-116888
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with th
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allo...
CVE-2026-116884
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.
【数据万象】 图片分析价格调整公告
【数据万象】 图片分析价格调整公告