hashi-vault-js has a path traversal and query parameter injection
CVE-2026-55100
## Summary The `hashi-vault-js` library is vulnerable to path traversal and query string injection due to the lack of p
#advisory
共收录 23634 条相关情报。
← 返回所有主题dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
CVE-2026-54729
## Summary is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yiel
Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)
CVE-2026-65835
### Summary CVE-2026-22872 (GHSA-qjjm-7j9w-pw72) reported that a Tenant Owner could create cluster-scoped resources (e.g
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
CVE-2026-65834
### Summary `CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex` and `ForbiddenAnnotations.Regex` are never v
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
CVE-2026-67550
## Summary `re2` validates the user-settable `lastIndex` against the subject's **UTF-8 byte length** but then uses it a
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
CVE-2026-68499
## Summary `String.prototype.match` with a **global** `RE2` collects all matches in a native loop that advances the cur
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII
CVE-2026-68501
### Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer `orderId` with no ownership
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
CVE-2026-68500
### Impact The shop payment webhook `POST /{_locale}/update-payment` (route `sylius_mollie_shop_payment_webhook`) ac
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
CVE-2026-56819
### Summary A remote, unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that e
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
CVE-2026-12075
### Summary `nltk.pathsec` provides an SSRF filter that NLTK documents as a security control, blocking loopback, private
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
CVE-2026-12061
### Summary `ReviewsCorpusReader` extracts feature annotations of the form *label* followed by a bracketed signed digit
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
CVE-2026-12072
### Summary A path-traversal vulnerability in `NKJPCorpusReader` allows an attacker who can influence the `fileids
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
CVE-2026-12074
### Summary `FramenetCorpusReader.frame(name)` interpolates a caller-supplied frame name into an XML file path that is r
`nx graph` dev server permissive CORS policy
CVE-2026-54753
## Summary The local HTTP server started by `nx graph` sent `Access-Control-Allow-Origin: *` on every response, letting
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
CVE-2026-41695
`src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175` · Unbounded Resource All
OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
CVE-2026-54706
### Summary OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serv
OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
CVE-2026-54706
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with frien
OnionShare Receive mode writes uploaded files even when file uploads are disabled
CVE-2026-54707
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with frien
OnionShare Receive mode writes uploaded files even when file uploads are disabled
CVE-2026-54707
### Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode `disable_files` setting at the file upload si
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
CVE-2026-52856
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a