#advisory

共收录 22911 条相关情报。

← 返回所有主题

安全公告2026-10-20 发布INFO

@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

CVE-2026-111753

An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37)

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-201 #cwe-359 #severity:medium

安全公告2026-10-20 发布INFO

markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

CVE-2026-111758

### Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with defaul

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-400 #cwe-407 #severity:high

安全公告2026-10-20 发布INFO

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

CVE-2026-111766

### Summary With `html: true`, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-400 #cwe-407 #severity:low

安全公告2026-10-20 发布INFO

MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another

CVE-2026-111770

### Summary In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-362 #severity:high

安全公告2026-10-20 发布INFO

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

CVE-2026-111768

### Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-770 #severity:high

安全公告2026-10-20 发布INFO

AIOHTTP: Absolute-form request targets can spoof Request.scheme

CVE-2026-111748

### Summary An attacker sending an absolute-form request can spoof the scheme used. ### Impact If user code depends o

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-807 #severity:medium

安全公告2026-10-20 发布INFO

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

CVE-2026-111749

### Summary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. ### Impact A user a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-565 #severity:low

安全公告2026-10-20 发布INFO

AIOHTTP: Connector pool exhaustion via Max-Age overflow

CVE-2026-111065

### Summary An overflow in Max-Age processing can skip closing a connection. ### Impact An attacker may be able to ex

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-770 #severity:medium

安全公告2026-10-20 发布INFO

AIOHTTP: Pure-Python parser request smuggling

CVE-2026-111750

### Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. ### Impact If users are using t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-444 #severity:medium

安全公告2026-10-20 发布INFO

AIOHTTP: File descriptor exhaustion in multipart requests

CVE-2026-111066

### Summary An attacker can exhaust file descriptors with specially crafted multipart requests. ### Impact If a handl

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-400 #cwe-770 #severity:high

安全公告2026-10-20 发布INFO

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

CVE-2026-112944

### Summary `launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI fl

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-88 #severity:medium

安全公告2026-10-20 发布INFO

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

CVE-2026-112942

### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On W

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-77 #severity:high

安全公告2026-10-20 发布INFO

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

CVE-2026-111771

### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issue

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-863 #severity:medium

安全公告2026-10-20 发布INFO

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-295 #severity:critical

安全公告2026-10-20 发布INFO

certifi bundles emSign root CAs with compromised intermediate CA keys

Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eig

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-295 #severity:critical

安全公告2026-10-20 发布INFO

【TDSQL-C MySQL 版】关于 DBStore 组件升级的公告

历史摘要 · 未重新核验 · 腾讯云安全公告

#tencent #cloud #advisory

安全公告2026-10-20 发布INFO

【云数据库 MySQL】关于云盘版实例架构升级的公告

历史摘要 · 未重新核验 · 腾讯云安全公告

#tencent #cloud #advisory

安全公告2026-10-20 发布INFO

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream...

CVE-2026-105299

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstrea

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #severity:high

安全公告2026-10-20 发布INFO

Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized...

CVE-2026-75753

Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send speci

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:medium

安全公告2026-10-20 发布INFO

Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent...

CVE-2026-17518

Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrup

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-121 #severity:high