hpack: Unbounded variable integer decoding can cause run-away computation on malformed input
CVE-2026-59980
### Impact Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2
#pip
共收录 834 条相关情报。
← 返回所有主题langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
## Summary `langchain-nvidia-ai-endpoints` versions before 1.4.2 accepted local filesystem paths as image inputs for Vi
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
CVE-2026-61732
## Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM m
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
### Impact When creating an Image or File with a very large filename, Plone can become unresponsive. Even if the content
plone.app.dexterity has a Denial of Service due to excessive title or description length
CVE-2026-57576
### Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if th
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
CVE-2026-93421
### Summary The `/__csp__` endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to st
Home Assistant: XSS in Statistics Graph Card
CVE-2026-91130
### Summary An authenticated party can add a malicious name to any statistics-capable entity, allowing for Cross-Site Sc
Home Assistant: mDNS Server-Side Request Forgery
CVE-2026-91129
## Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integra
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
CVE-2026-86062
### Summary The LightRAG WebUI renders assistant/answer chat content as **raw HTML** — `react-markdown` is configured wi
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
CVE-2026-85740
## Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack d
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
CVE-2026-85734
### Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can
lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function
CVE-2026-85725
### Summary When plaintext passwords are stored in AUTH_ACCOUNTS, the comparison uses Python's == operator which is not
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
CVE-2026-85709
### Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
CVE-2026-83805
### Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impac
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
CVE-2026-83801
### Impact _What kind of vulnerability is it? Who is impacted?_ It has two related instances that share the same root c
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
CVE-2026-77528
### Summary Autobahn Python enforces `maxMessagePayloadSize` against the compressed WebSocket frame length before permes
Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
CVE-2026-59163
### Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SH
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
CVE-2026-63349
AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process()
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
CVE-2026-63374
### Impact Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made
AnyIO process-pool workers can block indefinitely on undrained stderr
CVE-2026-64847
### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redi