node-tar: Process crash via PAX numeric path type confusion

CVE-2026-59871

### Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all

历史摘要 · 未重新核验 · GitHub Advisory

node-tar: Decompression/parse DoS via unlimited input

CVE-2026-59873

### Summary A **Decompression/parse DoS via unlimited input** vulnerability in `node-tar` allows an attacker to exhaust

历史摘要 · 未重新核验 · GitHub Advisory

node-tar: Negative tar entry size causes infinite loop in archive replace

CVE-2026-59874

### Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop fore

历史摘要 · 未重新核验 · GitHub Advisory

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

CVE-2026-59875

## Summary `node-tar` strips trailing `NUL` bytes from long-name (`L`) and long-linkpath (`K`) GNU extended headers but

历史摘要 · 未重新核验 · GitHub Advisory

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

CVE-2026-59725

### Impact An unauthenticated remote attacker can cause a denial of service in affected versions of **engine.io** by op

历史摘要 · 未重新核验 · GitHub Advisory

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

CVE-2026-13311

### Summary `shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses `Array.prototype.concat` as the

历史摘要 · 未重新核验 · GitHub Advisory

Directus: Authorization-dependent response served from unsegmented cache key

CVE-2026-61836

## Summary When response caching is enabled (`CACHE_ENABLED=true`), the cache-key derivation in `api/src/utils/get-cach

历史摘要 · 未重新核验 · GitHub Advisory

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

CVE-2026-61835

### Summary The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address `0.0.0.0`.

历史摘要 · 未重新核验 · GitHub Advisory

CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard

CVE-2026-55177

# Authenticated full-read SSRF in CloudTAK `/api/esri*` routes — user-controlled URL fetched with no IP-classification g

历史摘要 · 未重新核验 · GitHub Advisory

ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

CVE-2026-53496

## Summary ExifReader 4.40.0 can throw an uncaught `RangeError: Offset is outside the bounds of the DataView` while par

历史摘要 · 未重新核验 · GitHub Advisory

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

CVE-2026-53597

## Summary The TypeScript Prompty loader used `gray-matter` without overriding executable frontmatter engines. `gray-mat

历史摘要 · 未重新核验 · GitHub Advisory

Prompty: Arbitrary file read via file reference expansion

CVE-2026-53598

## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolv

历史摘要 · 未重新核验 · GitHub Advisory

mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath

CVE-2026-54561

### Impact `context_import` passed the caller-supplied `filePath` directly to `fs.readFileSync` with no path confinemen

历史摘要 · 未重新核验 · GitHub Advisory

TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

CVE-2026-54546

### Summary `PUT /api/basemap` (the basemap import endpoint) fetches an attacker-supplied URL server-side with **no SSR

历史摘要 · 未重新核验 · GitHub Advisory

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

CVE-2026-54504

### Summary `@andrea9293/mcp-documentation-server` v1.13.0 documents that a Web UI starts automatically on port `3080`.

历史摘要 · 未重新核验 · GitHub Advisory

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

CVE-2026-50289

### Summary On Linux, `systeminformation`'s `networkInterfaces()` is vulnerable to OS command injection through the Deb

历史摘要 · 未重新核验 · GitHub Advisory

dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

CVE-2026-50272

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without

历史摘要 · 未重新核验 · GitHub Advisory

websocket-driver: Resource limit bypass via message compression

CVE-2026-54490

### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can

历史摘要 · 未重新核验 · GitHub Advisory

websocket-driver: Message corruption via abuse of protocol length headers

CVE-2026-54466

### Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitra

历史摘要 · 未重新核验 · GitHub Advisory

obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

### Summary The Local REST API's `/vault/{path}` endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path *

历史摘要 · 未重新核验 · GitHub Advisory