Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution d...

CVE-2026-114131

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rul

来源摘录 · NVD

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

CVE-2026-114131

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rul

历史摘要 · 未重新核验 · OSV.dev

Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by...

CVE-2026-84747

Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows re

来源摘录 · NVD

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str...

CVE-2026-114116

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows...

CVE-2026-114104

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content val

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry na...

CVE-2026-114104

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content val

来源摘录 · NVD

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the ...

CVE-2026-112712

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() func

来源摘录 · NVD

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for H...

CVE-2026-110180

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from

历史摘要 · 未重新核验 · NVD

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and ...

CVE-2026-110682

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level number

来源摘录 · NVD

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

CVE-2026-100351

## Summary `openapi3filter.ValidationHandler.Middleware` validates requests with kin-openapi's legacy router, which sel

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first...

CVE-2026-109331

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse

历史摘要 · 未重新核验 · NVD

Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget

CVE-2026-109331

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse

历史摘要 · 未重新核验 · OSV.dev

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles bounda...

CVE-2026-107835

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.P

历史摘要 · 未重新核验 · NVD

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.Parse...

CVE-2026-107825

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI

历史摘要 · 未重新核验 · NVD

OWASP Coraza WAF: Cookie Parser Confusion

CVE-2026-107835

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.P

历史摘要 · 未重新核验 · OSV.dev

OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

CVE-2026-107825

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI

历史摘要 · 未重新核验 · OSV.dev

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configurat...

CVE-2026-106505

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdoc

历史摘要 · 未重新核验 · NVD

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

CVE-2026-86818

### Impact `fast-uri`'s `mailto` scheme parser compares each query field name to the reserved names (`to`, `subject`, `

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

## Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

### Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list,

历史摘要 · 未重新核验 · GitHub Advisory