NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-...

CVE-2026-73420

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the

历史摘要 · 未重新核验 · NVD

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/...

CVE-2026-73416

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

历史摘要 · 未重新核验 · NVD

NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

CVE-2026-73420

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the

历史摘要 · 未重新核验 · OSV.dev

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated a...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

历史摘要 · 未重新核验 · NVD

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers s...

CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and

历史摘要 · 未重新核验 · NVD

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDoma...

CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of

历史摘要 · 未重新核验 · NVD

Guzzle: Noncanonical host can bypass host-based checks

CVE-2026-69246

### Impact In affected versions, Guzzle gives a transport the request URI as text and supplies the `Host` header separa

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Noncanonical cookie domain keeps subdomain scope

CVE-2026-69245

### Impact `SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the

历史摘要 · 未重新核验 · GitHub Advisory

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template UR...

CVE-2026-62999

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-direc

历史摘要 · 未重新核验 · NVD

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

## Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address **befor

历史摘要 · 未重新核验 · GitHub Advisory

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab's PyPI extension manager enforces `blocked_extensions_uris` by comparing the requested install name to blockl

历史摘要 · 未重新核验 · GitHub Advisory

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in li...

CVE-2026-52747

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to

历史摘要 · 未重新核验 · NVD

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal befo...

CVE-2026-49984

Kestra 是一个开源事件驱动编排平台。其本地内部存储后端（local internal-storage backend）在处理用户提供的文件路径时存在路径遍历漏洞。具体而言，后端在将 Windows 风格的反斜杠（\）转换为正斜杠（/）

历史摘要 · 未重新核验 · NVD

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in th...

CVE-2026-48721

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp c

历史摘要 · 未重新核验 · NVD

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use ...

CVE-2026-42462

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10

历史摘要 · 未重新核验 · NVD

Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass

CVE-2026-44180

### Summary Jupyter Enterprise Gateway has a prohibited UID and GID feature that by default prevents launching kernels

历史摘要 · 未重新核验 · GitHub Advisory

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstr...

CVE-2026-45022

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may par

历史摘要 · 未重新核验 · NVD

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

CVE-2026-42462

### Summary An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify

历史摘要 · 未重新核验 · GitHub Advisory