Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read

CVE-2026-55846

## Summary The built-in HTTP server started by `allure serve` and `allure open` is vulnerable to path traversal. The se

历史摘要 · 未重新核验 · GitHub Advisory

Armeria: External Control of File Name or Path in xDS SDS DataSource

CVE-2026-11752

## External Control of File Name or Path in xDS SDS DataSource ### Summary `DataSourceStream` in the `:xds` module res

历史摘要 · 未重新核验 · GitHub Advisory

NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)

CVE-2026-54683

## Summary A previous advisory (CVE-2026-49463 / GHSA-qpm9-h556-mwxm) reported that any logged-in user could download a

历史摘要 · 未重新核验 · GitHub Advisory

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

CVE-2026-55471

### Summary `org.hl7.fhir.utilities.XsltUtilities` exposes two parallel families of XSLT transform helpers. The `transf

历史摘要 · 未重新核验 · GitHub Advisory

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

CVE-2026-55470

## Summary The fix for CVE-2026-45367 added `RegexTimeout` protection to the `matches()` function in DSTU2016MAY, DSTU3,

历史摘要 · 未重新核验 · GitHub Advisory

handlebars.java FileTemplateLoader Path Traversal

CVE-2026-55760

### Impact Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or Clas

历史摘要 · 未重新核验 · GitHub Advisory

LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

CVE-2026-55405

### Summary The MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter **keys**

历史摘要 · 未重新核验 · GitHub Advisory

Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature

CVE-2026-50560

### Summary Netty HTTP/2 max header size handling produces attack similar to HTTP/2 Rapid Reset. ### Details There is

历史摘要 · 未重新核验 · GitHub Advisory

Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

CVE-2026-50020

## Summary Before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOContro

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length

CVE-2026-50011

### Summary RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count dec

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Wrapping plain trust manager silently disables hostname verification

CVE-2026-50010

SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X5

历史摘要 · 未重新核验 · GitHub Advisory

Netty: QUIC stateless reset token material exposed through header-visible connection IDs

CVE-2026-50009

### Summary Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connectio

历史摘要 · 未重新核验 · GitHub Advisory

Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

CVE-2026-48748

### Summary A memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blo

历史摘要 · 未重新核验 · GitHub Advisory

ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing

## Summary The DER parser used for application-supplied private keys did not safely validate encoded length values befo

历史摘要 · 未重新核验 · GitHub Advisory

ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation

## Summary The SSH protocol parser trusted attacker-controlled length and count fields without first checking that the

历史摘要 · 未重新核验 · GitHub Advisory

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

CVE-2025-27511

## Summary Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Executio

历史摘要 · 未重新核验 · GitHub Advisory

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

CVE-2026-48059

### Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client se

历史摘要 · 未重新核验 · GitHub Advisory

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

CVE-2026-48043

### Impact The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream

历史摘要 · 未重新核验 · GitHub Advisory

netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access

CVE-2026-48040

The netty-incubator-codec-ohttp library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. W

历史摘要 · 未重新核验 · GitHub Advisory

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

CVE-2026-48006

### Impact The RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connect

历史摘要 · 未重新核验 · GitHub Advisory