undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
CVE-2026-13697
### Summary Two issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`: 1. **Shared
#cwe-200
共收录 1778 条相关情报。
← 返回所有主题PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attack...
CVE-2026-69153
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
CVE-2026-69153
## Summary The fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restric
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP...
CVE-2026-67357
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attacke...
CVE-2026-67357
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1...
CVE-2026-67343
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing a
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers...
CVE-2026-67339
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cUR
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker...
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hard
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()....
CVE-2026-67322
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied rem
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterTok...
CVE-2026-67343
ArcadeDB 是一个多模型数据库。在 26.7.2 之前的版本中，GET /api/v1/server 端点未能正确对集群令牌（arcadedb.ha.clusterToken）进行脱敏处理，导致任何经过身份认证的用户都可以通过该接口以
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials throu...
CVE-2026-67339
CVE-2026-67339 影响 guzzlehttp/guzzle 库 7.14.2 之前的版本，该库是 PHP 生态中广泛使用的 HTTP 客户端组件。漏洞核心在于 cURL 处理器对 Proxy-Authorization 头的隔离
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-...
CVE-2026-67322
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied rem
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-proto...
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hard
ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server
CVE-2026-67343
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing a
axios before 0.33.0 Prototype Pollution via Node HTTP adapter
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hard
guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure
CVE-2026-67339
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cUR
GitPython before 3.1.52 Environment Variable Exfiltration via clone_from
CVE-2026-67322
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied rem
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to...
CVE-2026-18059
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exp
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in...
CVE-2026-2916
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via th...
CVE-2026-18059
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exp