No Title

CVE-2025-47950

### Summary CoreDNS' DNS-over-QUIC (DoQ) server can be driven into large goroutine and memory growth by a remote client

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.4.5, < 2026.4.20` - Patched v

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `< 2026.4.20` - Patched version: `2026

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Summary Fiber cache middleware's default key generator uses only `c.Path()` and does not include the query string. A

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Summary CoreDNS' tsig plugin can be bypassed on non-plain-DNS transports because it trusts the transport writer's Ts

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Summary CoreDNS' transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Summary CoreDNS's DNS-over-HTTPS (DoH) GET path accepts oversized `dns=` query values and performs substantial requ

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Summary The gRPC, QUIC, DoH, and DoH3 transports in CoreDNS incorrectly handle TSIG authentication. For gRPC and Q

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Summary The HTML Writer in PhpSpreadsheet bypasses `htmlspecialchars()` output escaping when a cell uses a custom nu

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Summary The Zipkin exporter remote endpoint cache accepted unbounded key growth derived from span attributes. In hi

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

It was discovered that there is a way to bypass HTML escaping in the HTML writer using custom number format codes. ## T

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

[MOCK] 这是一个厂商公告的伪摘要: No Title

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Impact The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site script

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

CVE-2025-54881

### Impact `@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid r

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

CVE-2026-32595

## Summary There is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to en

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Impact _What kind of vulnerability is it? Who is impacted?_ **Command Injection vulnerabilities in electerm:** A c

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

gitverify is still a prototype. ### Impact The bug is related to `requireSignedTags` which is on by default: an unsigne

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Summary An unchecked type assertion in the `forEach` mutation handler allows any user with permission to create a `

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to create page

历史摘要 · 未重新核验 · GitHub Security Advisories

No Title

### Summary Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This

历史摘要 · 未重新核验 · GitHub Security Advisories