#cwe-20

共收录 1723 条相关情报。

← 返回所有主题

漏洞预警2026-08-05 发布INFO

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and...

CVE-2026-71318

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-05 发布INFO

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security revie...

CVE-2026-20303

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering t

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-05 发布INFO

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security revie...

CVE-2026-20273

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering t

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-05 发布INFO

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did ...

CVE-2026-70603

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6,

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-158

安全公告2026-08-04 发布INFO

An improper neutralization of special elements used in an operating system command vulnerability...

CVE-2026-16793

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-20 #severity:high

安全公告2026-08-04 发布INFO

Ghost: Archived Offers can be Redeemed

CVE-2026-70589

### Impact A missing validation check allowed users to redeem subscription offers that were no longer active. ### Vuln

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-20 #severity:medium

漏洞预警2026-08-04 发布INFO

Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised loca...

CVE-2026-11835

Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateRese

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-367

安全公告2026-08-03 发布INFO

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

CVE-2026-59881

### Summary The client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extensi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-20 #severity:medium

漏洞预警2026-08-03 发布INFO

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSub...

CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, ev

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-918

漏洞预警2026-08-03 发布INFO

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it...

CVE-2026-69192

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-918

漏洞预警2026-08-03 发布INFO

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait...

CVE-2026-69185

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a sp

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-754

安全公告2026-08-03 发布INFO

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

CVE-2026-69192

### Summary `Address4` accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL hos

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-20 #cwe-918 #severity:high

安全公告2026-08-03 发布INFO

ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

CVE-2026-69198

### Summary Every special-use classification method is built on `isInSubnet`, which short-circuits to `false` whenever

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-20 #cwe-918 #severity:medium

安全公告2026-08-03 发布INFO

ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

CVE-2026-54272

### Summary `Address6`'s special-property checks misclassify IPv4-mapped (`::ffff:0:0/96`) and NAT64 well-known (`64:ff

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-20 #cwe-918 #severity:medium

安全公告2026-08-03 发布INFO

Socket.IO: Zero-attachment Memory Exhaustion

CVE-2026-69185

### Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and b

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-20 #cwe-754 #severity:high

漏洞预警2026-08-03 发布INFO

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVE-2026-21555

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-03 发布INFO

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVE-2026-21554

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-03 发布INFO

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVE-2026-21553

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-03 发布INFO

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVE-2026-21552

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-08-03 发布INFO

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVE-2026-21551

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

历史摘要 · 未重新核验 · NVD

#cve #cwe-20