共收录 259 条相关情报。
← 返回所有主题CVE-2026-106451
### Summary When no system-installed `liblz4-java` is found, `net.jpountz.util.Native.load()` extracts the bundled nati
CVE-2026-106449
### Summary When `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated
CVE-2026-106450
### Summary `LZ4FrameInputStream` allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every
CVE-2026-86597
Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers
CVE-2026-89425
## Status **FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a 20,000,109-character
CVE-2026-89407
## Status **FULLY REPRODUCED** with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for
CVE-2026-83557
### Summary `DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever `@JsonTypeIn
CVE-2026-68497
### Summary `jackson-databind` 3.2.1 deserializes a JSON **string** bound to a `javax.xml.datatype.Duration` or `javax.x
CVE-2026-19032
### Summary A `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.des
CVE-2026-77310
### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deseri
CVE-2026-61741
http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. These decoders use
CVE-2026-61814
`AsyncParser` can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across
CVE-2026-59990
The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input. ### Impact A remote atta
CVE-2026-77421
### Summary When regex search mode is enabled in the JLine3 `nano` editor, the user-supplied search term is compiled di
CVE-2026-77422
### Summary The JLine3 built-in `grep` command wraps the user-supplied regular expression with `.*` before compiling it
CVE-2026-77420
### Summary The JLine3 `HISTORY_IGNORE` variable is converted into a Java regular expression with only partial escaping
CVE-2026-85724
moquette is reachable by untrusted MQTT clients (anonymous by default), so every byte from any client, including pre-aut
CVE-2026-85058
## Summary Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testam
CVE-2026-81876
### Summary A malformed Smart Health Card (SHC) JWT with `zip: "DEF"` and an empty or truncated DEFLATE payload causes `
CVE-2026-81875
### Summary `SHCParser` inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit