共收录 34 条相关情报。
← 返回所有主题CVE-2026-110816
## Summary `qs.stringify(obj, { arrayFormat: 'comma' })` throws an uncaught `TypeError: Cannot convert object to primit
CVE-2026-105754
## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit
CVE-2026-105754
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint
CVE-2026-104420
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scorin
CVE-2026-104420
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scorin
CVE-2026-50278
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 h
CVE-2026-10080
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field ty
CVE-2026-10080
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field ty
CVE-2026-15826
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up t
CVE-2026-53798
rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that al
CVE-2026-53798
rsync tbefore 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that a
CVE-2026-73429
Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session wi
CVE-2026-18675
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose ki
CVE-2026-6726
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker wi
CVE-2026-59871
### Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all
CVE-2026-50337
Incorrect type conversion or cast in Windows Notification allows an authorized attacker to elevate privileges locally.
CVE-2026-59871
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and lin
CVE-2026-59871
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and lin
CVE-2026-55076
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,
CVE-2026-55076
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,