undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
CVE-2026-85024
## Impact undici's WebSocket client (including Node.js's bundled `globalThis.WebSocket`) crashes the entire Node.js pro
#npm
共收录 1041 条相关情报。
← 返回所有主题multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
CVE-2026-88932
### Impact Multer's `diskStorage` can leave complete, orphaned files on disk when a multipart upload is aborted in the
morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
CVE-2026-87859
### Impact Morgan writes attacker-controlled request data to the access log. Its escaping (added in 1.11.0 and 1.12.0)
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
CVE-2026-101895
A Denial of Service (DoS) vulnerability exists in `@angular/platform-server`'s DOM emulation parser (`domino`). When pro
fast-uri vulnerable to authority injection via an unvalidated port in serialize
CVE-2026-84292
### Impact `fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
CVE-2026-84394
### Impact `fast-uri` accepts a host that contains an unbalanced or misplaced authority bracket (`[` or `]`) without re
ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
CVE-2026-101913
### Summary `Address6.isLinkLocal()` recognizes `fe80::/64` rather than `fe80::/10`. Link-local unicast is the whole `/
ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
CVE-2026-101910
### Summary No classifier on `Address6` recognizes the NAT64 local-use range `64:ff9b:1::/48` (RFC 8215). `isPrivate()`
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
CVE-2026-88058
### Summary An XSS vulnerability exists in `@angular/platform-server` during server-side rendering (SSR) HTML serializat
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
CVE-2026-101914
### Impact When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match in
scim-patch: Mutation of Inherited Built-in Method Objects
CVE-2026-61834
## Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects `scim-patch` blocks
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
## `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78) ### Summary The `grep_search` tool
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
CVE-2026-86439
## Overview Verified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memo
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
### Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifyi
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
CVE-2026-59723
### Summary The Cline Hub dashboard server (`@cline/cline-hub`), launched via the `cline dashboard` CLI command, accept
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
CVE-2026-61782
### Summary The default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interface
@bytebase/dbhub's read-only mode does not prevent database writes
CVE-2026-61788
### Summary Setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
CVE-2026-61742
### Summary DBHub `0.21.2` exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport
xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
CVE-2026-61784
xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString()
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
CVE-2026-56744
Reported by @echennells (Eric Chennells). Migrated from public issue #191 to a private advisory. **Affected:** `@bsv/wa