#cwe-400

共收录 1367 条相关情报。

漏洞预警2026-09-02 发布INFO

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdent...

CVE-2026-49249

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

安全公告2026-09-02 发布INFO

Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2

CVE-2026-49249

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-400 #cwe-770

漏洞预警2026-09-02 发布INFO

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's r...

CVE-2026-19475

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

安全公告2026-09-02 发布INFO

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects...

CVE-2026-84289

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-400 #severity:low

漏洞预警2026-09-01 发布INFO

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sour...

CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/load

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-407

漏洞预警2026-09-01 发布INFO

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP Tool. ...

CVE-2026-84289

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-789

安全公告2026-09-01 发布INFO

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/load

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-400 #cwe-407

安全公告2026-09-01 发布INFO

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

CVE-2026-84304

### Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into mi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-400 #severity:high

漏洞预警2026-09-01 发布INFO

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested object...

CVE-2026-84364

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody()

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability results in the ability to interrupt ...

CVE-2026-73773

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation o

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets. Successful exploit...

CVE-2026-73759

Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the normal operation of a v...

CVE-2026-73754

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

安全公告2026-09-01 发布INFO

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

CVE-2026-84364

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody()

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-400

漏洞预警2026-09-01 发布INFO

A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service....

CVE-2026-73746

A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to...

CVE-2026-73744

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that co

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. ...

CVE-2026-73728

Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Composer that could allow an authenticated l

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-01 发布INFO

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could ...

CVE-2026-73715

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

安全公告2026-09-01 发布INFO

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

CVE-2026-73228

## Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level `re

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-400 #cwe-770 #severity:medium

漏洞预警2026-09-01 发布INFO

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer,...

CVE-2026-84304

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragment

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

安全公告2026-09-01 发布INFO

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

CVE-2026-84304

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragment

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-400