pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
CVE-2026-48484
## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole
#cwe-20
共收录 1721 条相关情报。
← 返回所有主题Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource ...
CVE-2026-103413
Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled
Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
CVE-2026-103413
Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor...
CVE-2026-107734
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is
SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors
CVE-2026-107734
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a m...
CVE-2026-107726
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.1
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is...
CVE-2026-107720
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned
Hazelcast allows arbitrary member memory access by low-privileged client
CVE-2026-107726
### Impact A flaw has been found in Hazelcast Enterprise Edition and Community Edition, which would allow a low-privile
Banks: User-controlled prompt input can be parsed as privileged chat messages
CVE-2026-107717
## Summary Banks' `Prompt.chat_messages()` method parses every rendered output line as a potential `ChatMessage` JSON
Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-107726
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.1
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
CVE-2026-107720
### Summary `createVerifier` in fast-jwt ≤ 6.3.0 skips signature verification entirely when the `key` option is a falsy
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
CVE-2026-61427
## Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaul
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
CVE-2026-107720
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned
An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG...
CVE-2023-5649
An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role...
CVE-2026-76279
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect c
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role...
CVE-2026-76277
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user cap
Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-bac...
CVE-2026-106491
Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend pack
Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling
CVE-2026-41508
## Root Cause File: `internal/bodyprocessors/multipart.go` (since commit `3347961b`, PR #1453 *"feat: ignore unexpected
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quot...
CVE-2026-106512
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by dire
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image v...
CVE-2026-106443
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py p