共收录 257 条相关情报。
← 返回所有主题CVE-2026-53433
fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to ineff
CVE-2026-13149
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time comple
CVE-2026-45822
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' produci
CVE-2026-49293
## Summary `js-toml` versions up to and including **1.1.0** parse hexadecimal / octal / binary integer literals via a h
CVE-2026-13311
shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, whic
CVE-2026-49851
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustio
CVE-2026-48516
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter constructs a
CVE-2026-48511
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize po
CVE-2026-48502
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can
CVE-2026-49460
pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can cr
CVE-2026-53539
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlenc
CVE-2026-53550
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0, a crafted YAML document can trigger algorithmic CPU exha
CVE-2026-55206
### Summary PackInfo._read() uses an O(n^2) cumulative sum pattern where numstreams is read directly from the archive
CVE-2026-49293
js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 pa
CVE-2026-48988
### Summary A quadratic time complexity vulnerability exists in markdown-it's smartquotes rule (enabled via the `typogr
CVE-2026-53539
### Summary When parsing `application/x-www-form-urlencoded` bodies, `QuerystringParser` located the field separator wi
CVE-2026-45664
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-
CVE-2026-41850
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic
CVE-2026-11312
A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in th
CVE-2026-3276
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs