#cwe-20

共收录 1738 条相关情报。

← 返回所有主题

漏洞预警2026-06-24 发布INFO

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.2...

CVE-2026-12537

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1)

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-24 发布INFO

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.34 in Java applications, allows an attacker to execute arb...

CVE-2026-13006

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.3

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-23 发布INFO

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritat...

CVE-2026-54588

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-601

漏洞预警2026-06-23 发布HIGH

A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser. In subsys/bluetooth/host/classic/sdp.c, bt_sdp_parse_attribute() accepts an...

CVE-2026-10651

该漏洞存在于 Zephyr RTOS 的蓝牙经典 SDP 解析器中。在 subsys/bluetooth/host/classic/sdp.c 文件的 bt_sdp_parse_attribute() 函数中，当输入缓冲区包含 1 字节的属

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-617

安全公告2026-06-23 发布INFO

Gogs has the ability to import local repositories via Mirror Settings

CVE-2026-52801

### Summary The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration func

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-20 #severity:high

漏洞预警2026-06-22 发布INFO

Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zer...

CVE-2026-56306

Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypa

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-22 发布INFO

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_by...

CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dum

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-06-22 发布INFO

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression ...

CVE-2026-48109

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optiona

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

安全公告2026-06-22 发布INFO

Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected)

CVE-2026-44778

## Summary A malicious container can crash or destabilize the privileged Inspektor Gadget process when a **gadget using

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-20 #severity:low

安全公告2026-06-22 发布INFO

AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

CVE-2026-33692

## Vulnerability Details **CWE**: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Direc

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-20 #severity:high

漏洞预警2026-06-22 发布INFO

Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime w...

CVE-2026-54299

Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const p

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-918

漏洞预警2026-06-22 发布INFO

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or ...

CVE-2026-55602

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middlewar

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-187

漏洞预警2026-06-22 发布INFO

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Messa...

CVE-2026-53537

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Dispos

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-436

安全公告2026-06-22 发布INFO

OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature

CVE-2026-21887

### Summary The OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-20 #cwe-918 #severity:high

安全公告2026-06-22 发布INFO

Gogs has a Denial of Service in repository/wiki file listing web pages

CVE-2025-64719

### Summary A malicious user with rights to create a new file on a repository or wiki page can trigger a denial of servi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-20 #severity:medium

漏洞预警2026-06-22 发布INFO

The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'keyJugadorObjectiu' parameters allow the modification of other users’ information without...

CVE-2026-7165

The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'keyJugadorObjectiu' parameters a

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

安全公告2026-06-21 发布INFO

A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0...

CVE-2026-12787

A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unk

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-20 #severity:low

漏洞预警2026-06-21 发布INFO

A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The m...

CVE-2026-12787

A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unk

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-502

安全公告2026-06-20 发布INFO

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal...

CVE-2026-56340

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because P

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-20 #severity:high

漏洞预警2026-06-20 发布HIGH

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default...

CVE-2026-56340

vLLM 版本 >= 0.10.2 且 < 0.13.0 在多模态嵌入处理中缺少对稀疏张量的验证。由于 PyTorch 默认禁用稀疏张量不变性检查，攻击者可以在启用了 prompt-embeds 功能的情况下，提交精心构造的嵌入请求，其中包

历史摘要 · 未重新核验 · NVD

#cve #cwe-20