LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
CVE-2026-115883
### Summary The Postgres and SQLite stores save a namespace as its labels joined with `.`, so `("tenant", "bob")` and `
#cwe-20
共收录 1721 条相关情报。
← 返回所有主题Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
### Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one tha
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
### Vulnerability summary addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
### Vulnerability summary addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted loca
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110180
### Impact `fast-uri` versions `>= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family U
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) ac...
CVE-2026-55444
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strip...
CVE-2026-55442
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.0
baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a pub...
CVE-2026-115479
baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated v
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts c...
CVE-2026-57210
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded ...
CVE-2026-57209
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heim
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalid...
CVE-2026-115384
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malici
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Impacted is an unknown function of the file patappointtime....
CVE-2026-115249
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Im
pypdf: Unvalidated JPEG image data loading
CVE-2026-113786
### Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called.
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be proc...
CVE-2024-6423
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data t
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot...
CVE-2026-114099
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST na
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body...
CVE-2026-114100
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compar
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which...
CVE-2026-114101
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 f
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such...
CVE-2020-37289
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties...
CVE-2026-114099
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST na
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. M...
CVE-2020-37289
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to