When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new...
CVE-2026-56853
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they
#advisory
共收录 23530 条相关情报。
← 返回所有主题Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested,...
CVE-2026-33818
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to...
CVE-2026-19752
A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affect
Previously, pathological inputs could close an unescaped '/' early, allowing for attack...
CVE-2026-56858
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitr
A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this...
CVE-2026-19750
A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown func
DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversal
CVE-2026-19763
A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory
DTStack Taier Chunk-Check Endpoint FileChunkController.java Paths.ge path traversal
CVE-2026-19762
A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file Fi
DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversal
CVE-2026-19761
A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the
dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal
CVE-2026-19758
A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the fil
Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal
CVE-2026-19757
A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAn
Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal
CVE-2026-19756
A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjec
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
CVE-2026-73304
Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
CVE-2026-73408
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multip
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
CVE-2026-73302
Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/pa
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
CVE-2026-73417
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit
Trix: Stored XSS via HTMLParser attribute injection on paste
CVE-2026-73428
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to sto
NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
CVE-2026-73420
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
CVE-2026-73843
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gate
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
CVE-2026-73841
OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchore
Budibase before 3.40.0 Credential Exposure via STRING Fields
CVE-2026-72857
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated user