fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
CVE-2026-75975
### Impact `fast-uri` does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed liter
#advisory
共收录 23717 条相关情报。
← 返回所有主题fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
CVE-2026-75899
### Impact `fast-uri` decodes a hostname's percent escapes twice in a single `normalize()` or `resolve()` call: once du
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
CVE-2026-76172
### Impact `fast-uri` decodes percent-encoded characters in the scheme component with the legacy global `unescape()` an
NLTK: Default ENFORCE=False Disables All pathsec Security Controls
CVE-2026-62388
NLTK's pathsec.py security module defaults to ENFORCE=False (line 24), which means all 8 security validation functions o
NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
CVE-2026-63311
There is an SSRF vulnerability in NLTK 3.9.4's network URL validation. The validate_network_url() function in nltk/paths
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
CVE-2026-83610
## Summary An `EntityReference` node can be created with an invalid, attacker-controlled name through `Document.createE
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
CVE-2026-76098
## Summary Mistune v3.3.2 is vulnerable to a Denial of Service (DoS) attack via uncontrolled recursion in the HTML rende
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
CVE-2026-16732
## Impact The fix for [CVE-2026-3635](https://www.cve.org/CVERecord?id=CVE-2026-3635) ([GHSA-444r-cwp2-x5xf](https://gi
Authenticated SQL Injection via nested eager-loading criteria
CVE-2026-79991
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing th
GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
CVE-2026-84796 · CVE-2026-79990
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing th
Arbitrary user password reset leading to administrator account takeover
CVE-2026-72786 · CVE-2026-79989
The vulnerability allows any authenticated user to change their own password without providing the current password or h
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
CVE-2026-16647
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality
Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
CVE-2026-73475
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce Pa
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
CVE-2026-73478
Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
CVE-2026-73474
Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
CVE-2026-73476
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This
Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
CVE-2026-73477
Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versi
Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103
CVE-2026-81167
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Sug
Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104
CVE-2026-81165
Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from
CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105
CVE-2026-81168
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functiona