rclone local: crafted Range request against a translated symlink panics (DoS)
CVE-2026-88015
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1
#cwe-248
共收录 198 条相关情报。
← 返回所有主题multer vulnerable to Denial of Service via crafted multipart field names
CVE-2026-77078
### Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a sing
gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers
CVE-2026-84445
A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:a
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containi...
CVE-2026-82058
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges
PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send s...
CVE-2022-51014
PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when pro
PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding
CVE-2022-51014
PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when pro
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default Web...
CVE-2026-19534
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a s
undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while th...
CVE-2026-85024
undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zl
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean cl...
CVE-2026-85014
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connect
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the intercept...
CVE-2026-84947
undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares
Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature acc...
CVE-2026-72644
Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authe
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
CVE-2026-73088
## Vulnerability Details **File**: `node.js` **Function**: `normalizeStats()` (line ~214), reached from `getStat()` (ca
### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` d...
CVE-2026-82417
CVE-2026-82417 是 Node.js 的 qs 库（用于查询字符串解析与序列化）中的一个拒绝服务漏洞，影响版本 >=2.2.5 且 <6.16.0。漏洞根源在于 qs.stringify 在序列化非原始值时会调用 utils.i
An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld)...
CVE-2026-81517
An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough r
An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage bac...
CVE-2026-81517
An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough r
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError ...
CVE-2026-77078
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially c
ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeReq...
CVE-2026-55484
ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.
alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
CVE-2026-55484
### Summary A single unauthenticated HTTP request to a path starting with `?` (e.g. `GET ? HTTP/1.1`) crashes the entire
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send craft...
CVE-2026-82254
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-cont
gitoxide before 0.69.0 Denial of Service via gix-pack
CVE-2026-82254
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-cont