A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function...

CVE-2026-75013

A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function setWizardCfg of the fi

历史摘要 · 未重新核验 · GitHub Advisory

An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute...

CVE-2026-68004

An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP pub

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by...

CVE-2026-75012

A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the func

历史摘要 · 未重新核验 · GitHub Advisory

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow...

CVE-2026-19589

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system

历史摘要 · 未重新核验 · GitHub Advisory

Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

CVE-2026-59903

### Summary Netty's `CorsHandler` silently overwrites existing `Vary` headers, enabling cache poisoning and sensitive in

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Memory Exhaustion in SctpMessageCompletionHandler

CVE-2026-59902

### Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticate

历史摘要 · 未重新核验 · GitHub Advisory

uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

## Summary The sigstore check on `metadata.json` is gated on the wrong side of the condition. `LoadMetadata` in `intern

历史摘要 · 未重新核验 · GitHub Advisory

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

CVE-2026-59893

### Summary sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL lit

历史摘要 · 未重新核验 · GitHub Advisory

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

CVE-2026-54284

### Summary `sqlparse` ships hard limits (`MAX_GROUPING_DEPTH=100`, `MAX_GROUPING_TOKENS=10000`) intended to bound pars

历史摘要 · 未重新核验 · GitHub Advisory

Etherpad has stored XSS in HTML export via unescaped attribute-pool values

CVE-2026-55090

Fix: PR #7905 (ether/etherpad). `getHTMLFromAtext` in `src/node/utils/ExportHtml.ts` interpolates values from the `expo

历史摘要 · 未重新核验 · GitHub Advisory

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes: - **Weak RNG for tokens (CWE-330):** author/sessio

历史摘要 · 未重新核验 · GitHub Advisory

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

CVE-2026-55062

### Summary Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary f

历史摘要 · 未重新核验 · GitHub Advisory

uniget CLI has an EDITOR Command Injection

CVE-2026-55061

### Summary The uniget CLI has a command injection vulnerability in [hooks.go](vscode-file://vscode-app/app/extra/vscode

历史摘要 · 未重新核验 · GitHub Advisory

vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

### Summary: The `bufferAllocLimit` defense (GHSA-6785-pvv7-mvg7) can be completely bypassed using `ArrayBuffer`, `Shar

历史摘要 · 未重新核验 · GitHub Advisory

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

# NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sib

历史摘要 · 未重新核验 · GitHub Advisory

vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

CVE-2026-47698

### Summary VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape fro

历史摘要 · 未重新核验 · GitHub Advisory

VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

CVE-2026-47686

**Affected:** vm2 { throw new Error('fail', { cause: process }); } } }); const result = vm.run

历史摘要 · 未重新核验 · GitHub Advisory

vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

CVE-2026-47683

## Summary vm2 bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike The `bufferAllocLimit` option

历史摘要 · 未重新核验 · GitHub Advisory

sqlparse: Quadratic O(n²) DoS in group_comments

CVE-2026-71491

### Summary A comment-only statement (`-- c\n`*n) may cause a Denial of Service (DoS). ### Details Location: [sqlparse/

历史摘要 · 未重新核验 · GitHub Advisory

Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

CVE-2026-68520

## Summary Glances provides `as_dict_secure()` explicitly designed for unauthenticated API access, with a docstring sta

历史摘要 · 未重新核验 · GitHub Advisory