共收录 198 条相关情报。
← 返回所有主题CVE-2026-63341
Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or
CVE-2026-119188
### Summary A connection created with `forge.tls.createConnection()` throws an uncaught `TypeError` from `process()` wh
CVE-2026-119188
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the
CVE-2026-119052
llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenti
CVE-2026-87018
## Impact undici crashes the client process when a TLS 1.2 server renegotiates after the connection is established and
CVE-2026-87029
## Impact undici's `decompress` interceptor forwards decompressed response data to the downstream handler from zlib str
CVE-2026-111107
A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticat
CVE-2026-110816
## Summary `qs.stringify(obj, { arrayFormat: 'comma' })` throws an uncaught `TypeError: Cannot convert object to primit
CVE-2026-109855
### Impact undici's experimental WebSocket client (enabled by default via `allowH2: true`) crashes the Node.js process
CVE-2026-117541
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash calle
CVE-2026-116589
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentati
CVE-2026-115892
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stre
CVE-2026-109869
### Impact undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than fiv
CVE-2026-113872
### Impact When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js proces
CVE-2026-111181
### Impact A single request can crash any application using `body-parser` with default options. When a request carries
CVE-2026-82231
A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the
CVE-2026-114102
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.
CVE-2026-114051
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens,
CVE-2026-114051
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens,
CVE-2026-62994
### Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configu