No description provided
CVE-2026-79895
No description provided
#severity:high
共收录 5396 条相关情报。
← 返回所有主题No description provided
CVE-2026-95706
No description provided
No description provided
CVE-2026-79884
No description provided
No description provided
CVE-2026-79885
No description provided
No description provided
CVE-2026-79882
No description provided
No description provided
CVE-2026-79877
No description provided
No description provided
CVE-2026-79883
No description provided
No description provided
CVE-2026-79879
No description provided
No description provided
CVE-2026-79880
No description provided
No description provided
CVE-2026-79881
No description provided
No description provided
CVE-2026-79878
No description provided
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
### Summary Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
CVE-2026-114145
### Summary `create_submodule(name, path, url)` clones a submodule into the repo's own `.git` directory before it reje
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
CVE-2026-114142
### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
CVE-2026-114141
## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables (`
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
CVE-2026-114143
## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted ke
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
CVE-2026-114144
### Summary `toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first boundin
Storybook dev server vulnerable to code injection from the local network
CVE-2026-114126
**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pa
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
CVE-2026-114604
## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
CVE-2026-75508
### Summary The parser's `max_tokens` limit — the documented defence against oversized GraphQL documents — did not coun