Playwright Capture permits access to local files and internal network resources during page capture
CVE-2026-44439
Playwright Capture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attac
#pip
共收录 834 条相关情报。
← 返回所有主题axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
## Summary The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key ret
vLLM Vulnerable to Remote DoS via Special-Token Placeholders
CVE-2026-44222
## Summary This report explains a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-o
ciguard: Web UI is missing HTTP defence-in-depth headers
## Summary ciguard's FastAPI Web UI (`src/ciguard/web/app.py`) does not set HTTP defence-in-depth headers. OWASP ZAP ba
ciguard: discover_pipeline_files follows symlinks out of scan root
CVE-2026-44220
## Summary The `discover_pipeline_files()` function in `src/ciguard/discovery.py` (introduced in v0.8.0 and used by the
ciguard: Container image runs as root (no USER directive)
CVE-2026-44218
## Summary The published `ghcr.io/jo-jo98/ciguard` container image inherits the default root user because the `Dockerfi
ciguard: SCA HTTP client reads response body without size cap
CVE-2026-44219
## Summary Both SCA HTTP clients (`src/ciguard/analyzer/sca/osv.py` and `src/ciguard/analyzer/sca/endoflife.py`) call `
PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
CVE-2026-42315
### Summary No sanitization of package folder name allows writing files anywhere outside the intended download directory
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
CVE-2026-43891
### Details The vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The
PyLoad Vulnerable to Path Traversal via Package Folder Name
CVE-2026-42314
Insufficient sanitization of package folder names allows writing files outside the intended download directory. ## Affe
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
CVE-2026-42304
### Details The twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during D
Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
CVE-2026-42303
### Summary Fides deployments that enable both subject identity verification and duplicate privacy request detection ar
JupyterHub has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
CVE-2026-42266
The allow-list of extensions that can be installed from PyPI Extension Manager (`allowed_extensions_uris`) is not correc
wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured
CVE-2026-43901
## Description ### Impact `wireshark-mcp` exposes a `wireshark_export_objects` MCP tool that accepts an attacker-contr
django-s3file is vulnerable to relative path traversal
CVE-2026-42196
### Impact `S3FileMiddleware` is vulnerable to relative path traversal attacks, where an attacker can use a modified req
requests-hardened is Vulnerable to Server-Side Request Forgery
CVE-2026-42175
The SSRF protection in `requests-hardened` prior to version 1.2.1 fails to block IP addresses within the RFC 6598 Shared
ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key
## Summary Between 2026-02 and 2026-04-24 a total of 22 public PyPI sdists of `ogham-mcp` contained development credent
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 /...
CVE-2026-42313
### Summary The `set_config_value()` API method (`@permission(Perms.SETTINGS)`) in `src/pyload/core/api/__init__.py` ga
pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
CVE-2026-42312
### Summary The `set_config_value()` API method (`@permission(Perms.SETTINGS)`) in `src/pyload/core/api/__init__.py` ga
ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView
CVE-2026-42601
The /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without