uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set
## Summary The sigstore check on `metadata.json` is gated on the wrong side of the condition. `LoadMetadata` in `intern
#severity:high
共收录 5387 条相关情报。
← 返回所有主题sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
CVE-2026-59893
### Summary sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL lit
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
CVE-2026-54284
### Summary `sqlparse` ships hard limits (`MAX_GROUPING_DEPTH=100`, `MAX_GROUPING_TOKENS=10000`) intended to bound pars
Etherpad has stored XSS in HTML export via unescaped attribute-pool values
CVE-2026-55090
Fix: PR #7905 (ether/etherpad). `getHTMLFromAtext` in `src/node/utils/ExportHtml.ts` interpolates values from the `expo
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
### Summary: The `bufferAllocLimit` defense (GHSA-6785-pvv7-mvg7) can be completely bypassed using `ArrayBuffer`, `Shar
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
CVE-2026-47683
## Summary vm2 bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike The `bufferAllocLimit` option
sqlparse: Quadratic O(n²) DoS in group_comments
CVE-2026-71491
### Summary A comment-only statement (`-- c\n`*n) may cause a Denial of Service (DoS). ### Details Location: [sqlparse/
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
CVE-2026-68519
## Summary In Glances 4.5.5 the `--disable-config-exec` flag was extended (GHSA-3vwc-qwhc-3mj7) to stop `secure_popen()`
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
CVE-2026-62982
## Summary CVE-2026-32608 ("Command Injection via Process Names in Action Command Templates") was fixed (commit `5680a5d
A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function...
CVE-2026-19959
A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /gofor
A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey...
CVE-2026-19961
A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of the file /goform/fo
Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent...
CVE-2026-74795
Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does n
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the...
CVE-2026-74794
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit prop
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in...
CVE-2026-74792
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer pa
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during...
CVE-2026-74796
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attack
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop...
CVE-2026-74789
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expe
Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function...
CVE-2026-74784
Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in...
CVE-2026-74786
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression...
CVE-2026-74785
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass exis
Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json...
CVE-2026-74787
Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks