#CVE

共收录 63078 条相关情报。

← 返回所有主题

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag...

CVE-2026-119141

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious

来源摘录 · NVD

#cve #cwe-1265

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start fu...

CVE-2026-119140

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious

来源摘录 · NVD

#cve #cwe-372

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker ...

CVE-2026-119139

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejec

来源摘录 · NVD

#cve #cwe-617

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons ...

CVE-2026-119138

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending ca

来源摘录 · NVD

#cve #cwe-617

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can defi...

CVE-2026-119137

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to cra

来源摘录 · NVD

#cve #cwe-674

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebA...

CVE-2026-119136

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and

来源摘录 · NVD

#cve #cwe-1265

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the ho...

CVE-2026-119135

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a differen

来源摘录 · NVD

#cve #cwe-617

漏洞预警2026-10-29 发布MEDIUM

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle alloca...

CVE-2026-119134

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-29 发布LOW

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number ...

CVE-2026-119133

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that caus

来源摘录 · NVD

#cve #cwe-758

漏洞预警2026-10-29 发布MEDIUM

Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused...

CVE-2026-119132

Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger

来源摘录 · NVD

#cve #cwe-617

漏洞预警2026-10-29 发布MEDIUM

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request U...

CVE-2026-119131

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http

来源摘录 · NVD

#cve #cwe-190

漏洞预警2026-10-29 发布LOW

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs ar...

CVE-2026-119130

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values

来源摘录 · NVD

#cve #cwe-20

漏洞预警2026-10-29 发布HIGH

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations ...

CVE-2026-119129

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that all

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-29 发布HIGH

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking...

CVE-2026-119128

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticat

来源摘录 · NVD

#cve #cwe-565

漏洞预警2026-10-29 发布HIGH

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-v...

CVE-2026-119127

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticate

来源摘录 · NVD

#cve #cwe-640

漏洞预警2026-10-29 发布LOW

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but r...

CVE-2026-119126

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values w

来源摘录 · NVD

#cve #cwe-754

漏洞预警2026-10-29 发布LOW

Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients with...

CVE-2026-119125

Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-29 发布MEDIUM

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can...

CVE-2026-119124

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause w

来源摘录 · NVD

#cve #cwe-122

漏洞预警2026-10-29 发布HIGH

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file f...

CVE-2026-119123

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-674

漏洞预警2026-10-29 发布MEDIUM

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_...

CVE-2026-119122

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API cl

来源摘录 · NVD

#cve #cwe-918