#cwe-400

共收录 1360 条相关情报。

← 返回所有主题
漏洞预警2026-10-29 发布MEDIUM

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component ...

CVE-2026-118590

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-29 发布MEDIUM

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation...

CVE-2026-118589

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42

来源摘录 · NVD

安全公告2026-10-28 发布MEDIUM

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

CVE-2026-115927

### Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have

来源摘录 · GitHub Advisory

漏洞预警2026-10-28 发布HIGH

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native...

CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in ind

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small com...

CVE-2026-118261

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded reque

来源摘录 · NVD

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete resp...

CVE-2026-118260

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies

来源摘录 · NVD / OSV.dev

漏洞预警2026-10-28 发布MEDIUM

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision ale...

CVE-2026-88858

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontr

来源摘录 · NVD

漏洞预警2026-10-28 发布INFO

When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before valida...

CVE-2026-114349

When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed

来源摘录 · NVD

漏洞预警2026-10-28 发布INFO

Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the by...

CVE-2026-111551

Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array,

来源摘录 · NVD

漏洞预警2026-10-28 发布INFO

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaini...

CVE-2026-111108

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sen

来源摘录 · NVD

漏洞预警2026-10-28 发布INFO

The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing it. ...

CVE-2026-111073

The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against tel

来源摘录 · NVD

漏洞预警2026-10-28 发布INFO

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expr...

CVE-2026-118276

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString o

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-28 发布MEDIUM

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.t...

CVE-2026-118275

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the

来源摘录 · NVD

安全公告2026-10-28 发布INFO

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the...

CVE-2026-118273

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-28 发布INFO

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some...

CVE-2026-118274

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality o

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-28 发布INFO

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an...

CVE-2026-118271

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the fi

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-28 发布INFO

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-...

CVE-2026-118274

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality o

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-28 发布INFO

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts...

CVE-2026-118273

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-28 发布INFO

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts ...

CVE-2026-118271

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the fi

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-27 发布MEDIUM

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_...

CVE-2026-116774

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65

来源摘录 · NVD