netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures
CVE-2026-41207
HKDF_expand: returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from fai
#maven
共收录 259 条相关情报。
← 返回所有主题XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
CVE-2026-48048
### Impact XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient and with slightly modified parameter
XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
CVE-2026-48047
### Impact A potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension in
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
CVE-2026-33137
### Impact `POST /wikis/{wikiName}` executes a XAR import without performing any authentication or authorization checks
Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
CVE-2026-45799
# CVE-2026-45799 ## Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before ski
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
CVE-2026-45367
## Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input
async-http-client: Cookie header not stripped on cross-origin redirect
CVE-2026-45300
## Summary async-http-client leaks `Cookie` headers to cross-origin redirect targets. When following a redirect across
Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client
CVE-2026-45575
### Impact An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substi
epa4all-client: TLS Certificate Validation Disabled in Production
CVE-2026-45574
### Impact An attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (se
Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy
CVE-2026-45083
### Summary The Goobi viewer REST endpoint `POST /api/v1/index/stream` accepted an arbitrary Solr streaming expression
Mapfish Print: Remote Code Injection (RCE) in Dynamic table
CVE-2026-44672
### Impact The attacker can execute arbitrary code without being authenticated ### Mitigation Upgrade to a patched ve
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
CVE-2026-45091
In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret
Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
CVE-2026-27478
**Context:** A critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.
Vert.x has a DoS via unbounded server-side SNI SslContext cache growth
CVE-2026-6860
Potential unbounded server-side SNI `SslContext` cache growth in Vert.x TLS handling, with possible resource-exhaustion
epa4all-client has a VAU Signature bypass
CVE-2026-44900
### Impact In SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the b
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
CVE-2026-44503
### Summary The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
CVE-2026-42587
## Summary `HttpContentDecompressor` accepts a `maxAllocation` parameter to limit decompression buffer size and prevent
Netty Redis Codec Encoder has a CRLF Injection Issue
CVE-2026-42586
# Security Vulnerability Report: CRLF Injection in Netty Redis Codec Encoder ## 1. Vulnerability Summary | Field | Val
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding
CVE-2026-42585
### Summary Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. ### Details Netty
Netty has HttpClientCodec response desynchronization
CVE-2026-42584
### Summary If HttpClientCodec is configured, there are use cases when a response body from one request, can be parsed