Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net rules but did not re...

CVE-2026-49859

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the des

历史摘要 · 未重新核验 · NVD

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

CVE-2026-54762

## Summary There is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns

CVE-2026-53853

### Summary OpenClaw's exec allowlist supported optional `argPattern` entries to restrict the arguments accepted for an

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Skill-command dispatch could skip before-tool-call hooks

CVE-2026-53845

### Summary Skill-command dispatch could skip before-tool-call hooks. In affected versions, a skill command routed thro

历史摘要 · 未重新核验 · GitHub Advisory

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, Context.spawn() creates a child Context for the {% rende...

CVE-2026-44646

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

历史摘要 · 未重新核验 · NVD

PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list,...

CVE-2025-71322

PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypas

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

CVE-2026-54013

# Stored XSS to Account Takeover via Model Profile Images in Open WebUI **Affected:** Open WebUI ` tags. On the output

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Python Code Node AST Validator Bypass

## Impact An authenticated user with permission to create or modify workflows containing a Python Code node could bypass

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist...

CVE-2026-53853

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through...

CVE-2026-53845

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables ...

CVE-2026-53853

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can e...

CVE-2026-53845

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch

历史摘要 · 未重新核验 · NVD

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVE-2026-12316

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

历史摘要 · 未重新核验 · NVD

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVE-2026-12315

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thund

历史摘要 · 未重新核验 · NVD

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVE-2026-12302

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firef

历史摘要 · 未重新核验 · NVD

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

## Impact A DOMPurify instance that is reused across trust boundaries can stay bound to a previously supplied `TRUSTED_

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBindingComposeW of the component Nucleus Engine Monitoring ...

CVE-2026-12214

A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBi

历史摘要 · 未重新核验 · NVD

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the receiver parameter and unconditionally write...

CVE-2026-47209

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231)

历史摘要 · 未重新核验 · NVD

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and in...

CVE-2026-47140

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins

历史摘要 · 未重新核验 · NVD

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuratio...

CVE-2026-47139

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins

历史摘要 · 未重新核验 · NVD