Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
CVE-2026-115895
## Summary The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolatin
#severity:high
共收录 5396 条相关情报。
← 返回所有主题filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
CVE-2026-112940
`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) hand SQLite a name they do not control.
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
### Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=
A potential security vulnerability has been identified in HP One Agent for certain HP PC products...
CVE-2026-91093
A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
CVE-2026-114055
## Summary API clients can supply arbitrary `mm_processor_kwargs` per request. vLLM forwards these values through the m
pypdf: Possible long runtimes for repeated references to the same missing object
CVE-2026-115572
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
CVE-2026-115585
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-re
pypdf: Possible long runtimes for large xref table header limits
CVE-2026-115580
### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening
Electron: Mitigation for compromised eMudhra intermediate certificates
CVE-2026-115570
### Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
CVE-2026-111181
### Impact A single request can crash any application using `body-parser` with default options. When a request carries
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
## Summary In the `gix` crate, `Cache::protect_options()` in `gix/src/config/cache/access.rs` reads the three filesyste
Echo: WebSocket proxy can retain connections and handlers after client disconnect
## Impact Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket cli
Echo: Decompress permits unbounded gzip expansion in v4
## Impact Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded si
Echo: BodyDump captures request and response bodies without size limits in v4
## Impact Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
CVE-2026-115419
**Summary** Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-a
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
CVE-2026-115586
## Summary The bash activator puts the caller-supplied prompt value into `PS1` unescaped whenever `promptvars` is off a
Mistune: Path Traversal and XSS in Include directive
CVE-2026-115355
The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
CVE-2026-115776
## Summary An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
CVE-2026-115778
## Summary An allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthen
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
CVE-2026-115775
## Summary An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote