Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture li...

CVE-2026-118263

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error

来源摘录 · NVD

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

## Impact Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring re

历史摘要 · 未重新核验 · GitHub Advisory

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to...

CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on

来源摘录 · NVD / OSV.dev

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service ...

CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaus

历史摘要 · 未重新核验 · GitHub Advisory

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service ...

CVE-2026-56388

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated

来源摘录 · NVD

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate...

CVE-2026-77207

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libres

历史摘要 · 未重新核验 · GitHub Advisory

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoa...

CVE-2026-107838

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded syste

历史摘要 · 未重新核验 · NVD

RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

CVE-2026-107838

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded syste

历史摘要 · 未重新核验 · OSV.dev

Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 byte...

CVE-2026-107785

Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering sessi

历史摘要 · 未重新核验 · NVD

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues...

CVE-2026-18397

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination

历史摘要 · 未重新核验 · NVD

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severit...

CVE-2026-95316

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially re

历史摘要 · 未重新核验 · NVD

In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse_dacl() silently accepts truncated ACEs and allocation failures, ...

CVE-2026-98114

In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse_dacl()

来源摘录 · NVD

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

CVE-2026-86141

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., i

历史摘要 · 未重新核验 · NVD

CVE-2026-86141

CVE-2026-86141

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., i

历史摘要 · 未重新核验 · OSV.dev

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default Web...

CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a s

历史摘要 · 未重新核验 · NVD

(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-mi...

CVE-2026-85649

(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the A

历史摘要 · 未重新核验 · NVD

CVE-2026-85649

CVE-2026-85649

(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the A

历史摘要 · 未重新核验 · OSV.dev

In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts...

CVE-2026-14957

In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not N

历史摘要 · 未重新核验 · GitHub Advisory

In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when p...

CVE-2026-14957

In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not N

历史摘要 · 未重新核验 · NVD

Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have the...

CVE-2026-78699

Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name t

历史摘要 · 未重新核验 · NVD