adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the...
CVE-2026-114103
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard b
#advisory
共收录 22948 条相关情报。
← 返回所有主题Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that...
CVE-2026-114095
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause in
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that...
CVE-2026-114098
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to writ
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows...
CVE-2026-114104
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content val
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated...
CVE-2026-114102
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows...
CVE-2026-114106
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout...
CVE-2026-114096
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allo
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which...
CVE-2026-114101
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 f
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows...
CVE-2026-114105
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setg
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter...
CVE-2026-114097
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allo
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on...
CVE-2026-114094
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrar
Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote...
CVE-2026-114093
Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out aut
Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the...
CVE-2026-114090
Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp serv
Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay...
CVE-2026-114091
Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler...
CVE-2026-114092
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run rep
Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI...
CVE-2026-114089
Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from...
CVE-2026-114087
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.examp
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator...
CVE-2026-114088
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that
Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams...
CVE-2026-114086
Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allow
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows...
CVE-2026-114080
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project me