#cwe-400

共收录 1396 条相关情报。

← 返回所有主题
漏洞预警2026-06-12 发布INFO

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates Ar...

CVE-2026-50011

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-12 发布INFO

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingD...

CVE-2026-48043

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-12 发布INFO

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoin...

CVE-2026-47244

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-12 发布INFO

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption...

CVE-2026-50645

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-12 发布INFO

Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and...

CVE-2026-45169

Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a v

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-12 发布INFO

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler...

CVE-2026-44892

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final,

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-11 发布INFO

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can ...

CVE-2026-44890

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-11 发布INFO

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can ...

CVE-2026-44250

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-11 发布INFO

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. Prior to version 2.6.7, an attacker can upload...

CVE-2026-45802

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as template

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-11 发布INFO

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from ...

CVE-2026-44496

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and befor

历史摘要 · 未重新核验 · NVD

安全公告2026-06-11 发布INFO

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

CVE-2026-48050

### Summary Arc registers Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/ap

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-06-11 发布INFO

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

CVE-2026-48045

### Impact `AsyncListener.handle_query_or_defer` retained every truncated (TC-bit) incoming query in `self._deferred[ad

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-06-11 发布INFO

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

CVE-2026-48043

### Impact The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-06-11 发布INFO

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

CVE-2026-48069

### Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all client

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-06-11 发布INFO

joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

CVE-2026-48038

### Impact Denial of service via untrapped exception in services validating user-supplied JSON / object input with recur

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-06-11 发布INFO

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()`...

CVE-2026-5497

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded f

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-10 发布INFO

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0 and prior to version 1.2.5, a client with push access could push a tiny ...

CVE-2026-47734

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0 and prior to ve

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-10 发布INFO

Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand neste...

CVE-2026-46689

Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endp

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-10 发布INFO

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer...

CVE-2026-46679

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decod...

CVE-2026-46522

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.2

历史摘要 · 未重新核验 · NVD