Cyber Security Daily Radar

#cwe-400

共收录 1360 条相关情报。

← 返回所有主题
漏洞预警2026-10-22 发布INFO

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Re...

CVE-2026-108359

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8,

来源摘录 · NVD

#cve#cwe-400#cwe-789
漏洞预警2026-10-22 发布HIGH

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only...

CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the pars

来源摘录 · NVD

#cve#cwe-400#cwe-770
安全公告2026-10-22 发布INFO

pypdf: Possible long runtimes/large memory usage when retrieving form fields

CVE-2026-113789

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtim

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-400#cwe-407#severity:medium
安全公告2026-10-22 发布INFO

pypdf: Possible large memory usage when parsing arrays and dictionaries

CVE-2026-113790

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires par

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-400#severity:medium
安全公告2026-10-22 发布INFO

pypdf: Possible large memory usage when parsing content streams

CVE-2026-113791

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires par

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-400#cwe-770#severity:medium
安全公告2026-10-22 发布INFO

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

CVE-2026-114144

### Summary `toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first boundin

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-400#cwe-770#severity:high
安全公告2026-10-22 发布INFO

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

CVE-2026-75508

### Summary The parser's `max_tokens` limit — the documented defence against oversized GraphQL documents — did not coun

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-400#cwe-770#severity:high
安全公告2026-10-22 发布INFO

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

CVE-2026-75507

### Summary The `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and in the worst case `O(

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-400#cwe-407#severity:high
漏洞预警2026-10-22 发布MEDIUM

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, re...

CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function

来源摘录 · NVD

#cve#cwe-1333#cwe-400
漏洞预警2026-10-21 发布HIGH

In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splu...

CVE-2026-76290

In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to

来源摘录 · NVD

#cve#cwe-400
漏洞预警2026-10-21 发布HIGH

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint...

CVE-2026-76288

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single cra

来源摘录 · NVD

#cve#cwe-400
漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplica...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py tre

历史摘要 · 未重新核验 · NVD

#cve#cwe-400#cwe-407
漏洞预警2026-10-21 发布MEDIUM

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to ...

CVE-2026-96638

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits

来源摘录 · NVD

#cve#cwe-400#cwe-770
漏洞预警2026-10-21 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without r...

CVE-2026-96637

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a l

历史摘要 · 未重新核验 · NVD

#cve#cwe-400#cwe-409
漏洞预警2026-10-21 发布MEDIUM

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Image._...

CVE-2026-96636

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DC

来源摘录 · NVD

#cve#cwe-400#cwe-409
漏洞预警2026-10-21 发布HIGH

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js ...

CVE-2026-114144

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal

来源摘录 · NVD

#cve#cwe-400#cwe-770
漏洞预警2026-10-21 发布HIGH

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number...

CVE-2026-114138

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in

来源摘录 · NVD

#cve#cwe-400#cwe-407
安全公告2026-10-21 发布INFO

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

CVE-2026-96636

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DC

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-400#cwe-409
安全公告2026-10-21 发布INFO

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py tre

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-400#cwe-407
安全公告2026-10-21 发布INFO

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

CVE-2026-96637

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a l

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-400#cwe-409