SafeInstall agent guard shell parsing can miss raw package execution
## Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in it
#cwe-178
共收录 92 条相关情报。
← 返回所有主题Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering
CVE-2026-48595
### Summary `Tesla.Middleware.FollowRedirects` is meant to strip the `Authorization` header when following a cross-orig
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive...
CVE-2026-55170
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the dat
JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce exc...
CVE-2026-54528
JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandl
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
CVE-2026-54528
JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandl
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased sp...
CVE-2026-54763
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestA
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected...
CVE-2026-14617
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function Gatewa
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gatewa...
CVE-2026-14617
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function Gatewa
Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a...
CVE-2026-58057
Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparis
Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insen...
CVE-2026-58057
Flowise 是一个低代码平台，允许用户构建和管理 AI 工作流。在版本 3.1.3 之前，Flowise 在验证自定义 MCP（Model Context Protocol）stdio 环境变量时存在一个缺陷：它使用了一个基于大小写敏感
Authelia has an Edge Case Access Control Rule Mismatch
CVE-2026-48794
### Impact **CVSSv4 Baseline Score:** Low 2.4 **CVSSv4 Weighted Score:** Low 1.3 The full CVSSv4 Vector for this vuln
@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter
CVE-2026-49336
### Summary `@microsoft/kiota-http-fetchlibrary`'s `RedirectHandler` is documented as stripping `Authorization` and `Co
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML:...
CVE-2026-57234
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse opti
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4....
CVE-2026-48794
CVE-2026-48794 是 Authelia 开源身份认证和授权服务器中的一个安全漏洞，影响版本 4.36.0 至 4.39.19。该漏洞源于在特定边缘情况下对域名的规范化处理缺失，导致访问控制规则可能被跳过。具体利用条件极为苛刻，包
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4....
CVE-2026-47203
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-o
@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, `@microsoft/kiota-http-...
CVE-2026-49336
@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-prev
TYPO3 CMS has Broken Access Control in its Form Framework
CVE-2026-47346
### Problem Backend users with file write permissions were able to upload form definition files with mixed-case extensio
Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule middleware bypass via case-se...
CVE-2026-53721
Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4
FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.I...
CVE-2026-45062
FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function
Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restricti...
CVE-2026-47346
Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .F