#cwe-180

共收录 38 条相关情报。

漏洞预警2026-10-28 发布MEDIUM

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters suc...

CVE-2026-118662

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate se

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-180 #cwe-284 #npm #severity:medium

安全公告2026-10-23 发布INFO

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

CVE-2026-110306

### Impact `fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-172 #cwe-180 #severity:medium

漏洞预警2026-10-23 发布MEDIUM

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms th...

CVE-2026-93630

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an una

来源摘录 · NVD

#cve #cwe-180

漏洞预警2026-10-23 发布HIGH

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFile...

CVE-2026-114622

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcTheme

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-180 #cwe-22

漏洞预警2026-10-20 发布INFO

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-...

CVE-2026-110306

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-172 #cwe-180

安全公告2026-10-15 发布INFO

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook...

CVE-2026-110846

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Se

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-180 #severity:high

漏洞预警2026-10-05 发布INFO

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming fr...

CVE-2026-93326

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build def

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

安全公告2026-10-03 发布INFO

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a...

CVE-2026-105050

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-180 #severity:high

漏洞预警2026-10-02 发布INFO

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string"...

CVE-2026-105050

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

安全公告2026-09-29 发布INFO

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

CVE-2026-102269

## Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alph

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-180 #severity:medium

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside ...

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected becau

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

漏洞预警2026-09-26 发布INFO

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters ...

CVE-2026-100674

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

安全公告2026-09-26 发布INFO

stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

CVE-2026-100674

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-180

安全公告2026-09-25 发布INFO

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0...

CVE-2026-95811

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-180

漏洞预警2026-09-01 发布INFO

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match ...

CVE-2026-82736

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-in

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

安全公告2026-09-01 发布INFO

Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

CVE-2026-82736

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-in

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-180

安全公告2026-08-29 发布INFO

The cohttp package before 6.3.0 for OCaml allows directory traversal.

CVE-2026-82481

The cohttp package before 6.3.0 for OCaml allows directory traversal.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-180 #severity:high

漏洞预警2026-08-29 发布INFO

The cohttp package before 6.3.0 for OCaml allows directory traversal.

CVE-2026-82481

The cohttp package before 6.3.0 for OCaml allows directory traversal.

历史摘要 · 未重新核验 · NVD

#cve #cwe-180

安全公告2026-08-29 发布INFO

CVE-2026-82481

The cohttp package before 6.3.0 for OCaml allows directory traversal.

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-180

漏洞预警2026-08-19 发布INFO

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound...

CVE-2026-76203

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 thr

历史摘要 · 未重新核验 · NVD

#cve #cwe-180