OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

CVE-2026-54285

## Overview `W3CBaggagePropagator.extract()` in `@opentelemetry/core` does not enforce size limits when parsing inbound

历史摘要 · 未重新核验 · GitHub Advisory

Nest: Middleware Bypass on Fastify via Trailing Slash

CVE-2026-54281

### Impact An authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`,

历史摘要 · 未重新核验 · GitHub Advisory

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

CVE-2026-54257

### Impact Most apps will crash and some may perform incorrect buffer allocations in the Node.js `Buffer` API resulting

历史摘要 · 未重新核验 · GitHub Advisory

UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

CVE-2026-48125

### Summary A regular expression denial-of-service (ReDoS) vulnerability has been discovered in `ua-parser-js` when usi

历史摘要 · 未重新核验 · GitHub Advisory

protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

CVE-2026-54271

## Summary A previous fix for unsafe name handling in `pbjs` static / static-module code generation was incomplete. Aff

历史摘要 · 未重新核验 · GitHub Advisory

protobufjs: Memory amplification from preserved unknown fields in binary decode

CVE-2026-54270

## Summary protobufjs 8.2.0 added support for preserving unknown fields encountered during binary decode. Affected vers

历史摘要 · 未重新核验 · GitHub Advisory

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

## Impact A DOMPurify instance that is reused across trust boundaries can stay bound to a previously supplied `TRUSTED_

历史摘要 · 未重新核验 · GitHub Advisory

Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

CVE-2026-44311

### Summary A potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-c

历史摘要 · 未重新核验 · GitHub Advisory

esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

### Summary The esbuild Deno module (`lib/deno/mod.ts`) downloads native binary executables from an npm registry and wr

历史摘要 · 未重新核验 · GitHub Advisory

esbuild allows arbitrary file read when running the development server on Windows

### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir

历史摘要 · 未重新核验 · GitHub Advisory

@hapi/inert has a static-file confinement bypass via sibling-prefix path

CVE-2026-48049

### Impact `@hapi/inert` serves static files from a directory configured with `path` (in the `directory` / `file` handle

历史摘要 · 未重新核验 · GitHub Advisory

@grpc/grpc-js: A malformed request can cause a server crash

CVE-2026-48068

### Impact An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers cr

历史摘要 · 未重新核验 · GitHub Advisory

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

CVE-2026-48069

### Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all client

历史摘要 · 未重新核验 · GitHub Advisory

joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

CVE-2026-48038

### Impact Denial of service via untrapped exception in services validating user-supplied JSON / object input with recur

历史摘要 · 未重新核验 · GitHub Advisory

OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

CVE-2026-48054

## Summary The OpenZeppelin Contracts Wizard generated Hardhat (`test/test.ts`) and Foundry (`test/.t.sol`) example tes

历史摘要 · 未重新核验 · GitHub Advisory

@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

CVE-2026-48022

### Impact Wreck strips credential headers (Authorization, Cookie, Proxy-Authorization) before following a cross-origin

历史摘要 · 未重新核验 · GitHub Advisory

Element Call reports full URLs of visited pages to analytics server

CVE-2026-48007

### Impact Element Call versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by

历史摘要 · 未重新核验 · GitHub Advisory

shell-quote quote() does not escape newlines in object .op values

CVE-2026-9277

### Summary `shell-quote`'s `quote()` function did not validate object-token inputs against the operator model used by

历史摘要 · 未重新核验 · GitHub Advisory

FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

CVE-2026-47721

## Summary An authorization issue in the Scheduler API allowed authenticated non-admin users to create or modify schedu

历史摘要 · 未重新核验 · GitHub Advisory

FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString

CVE-2026-47720

## Summary The TDengine DAQ storage connector's `escapeTdString` at `server/runtime/storage/tdengine/index.js:10` doubl

历史摘要 · 未重新核验 · GitHub Advisory