The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition in the consumptio...

CVE-2026-101041

The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check

历史摘要 · 未重新核验 · NVD

Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover

CVE-2026-101041

The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check

历史摘要 · 未重新核验 · OSV.dev

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail...

CVE-2026-100833

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all containe

历史摘要 · 未重新核验 · GitHub Advisory

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Contain...

CVE-2026-100833

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all containe

历史摘要 · 未重新核验 · NVD

Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address...

CVE-2026-100699

Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser)

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string...

CVE-2026-100699

Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser)

历史摘要 · 未重新核验 · NVD

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before conside...

CVE-2026-100664

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority

历史摘要 · 未重新核验 · NVD

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/...

CVE-2026-100663

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CON

历史摘要 · 未重新核验 · NVD

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinT...

CVE-2026-100652

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC fron

历史摘要 · 未重新核验 · NVD

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum ...

CVE-2026-100647

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-com

历史摘要 · 未重新核验 · NVD

Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment

CVE-2026-100699

Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser)

历史摘要 · 未重新核验 · OSV.dev

Netty 4.2.2 through 4.2.15 HTTP/1 Host Header Authority Confusion

CVE-2026-100664

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority

历史摘要 · 未重新核验 · OSV.dev

Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

CVE-2026-100663

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CON

历史摘要 · 未重新核验 · OSV.dev

vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

CVE-2026-100652

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC fron

历史摘要 · 未重新核验 · OSV.dev

vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

CVE-2026-100647

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-com

历史摘要 · 未重新核验 · OSV.dev

mpp vulnerable to Gas Draining with low gas limit

## Vulnerability When the server acts as the fee payer, `mpp` Elixir 0.4.0 (ZenHive/mpp) does not validate whether the `

历史摘要 · 未重新核验 · GitHub Advisory

mpp vulnerable to Gas Draining with access list

### Details When the server acts as the fee_payer, `mpp` Elixir 0.4.0 copies the client-supplied EIP-2930 access list ve

历史摘要 · 未重新核验 · GitHub Advisory

mpp vulnerable to Gas Draining with no limit

### Details When the server acts as the fee_payer, the `mpp` Elixir 0.4.0 does not validate `gas_limit`, `max_fee_per_ga

历史摘要 · 未重新核验 · GitHub Advisory

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

CVE-2026-82407

**Location:** `core/kapp/validators/validators.go:201` (`Register`), (`genesis/checking/nodesSetupChecker.go:73`). `core

历史摘要 · 未重新核验 · GitHub Advisory

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a...

CVE-2026-82407

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.g

历史摘要 · 未重新核验 · NVD