PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
CVE-2026-49286
### Summary `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-s
#severity:high
共收录 5441 条相关情报。
← 返回所有主题Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes
CVE-2026-47067
### Summary [CVE-2026-47067](https://nvd.nist.gov/vuln/detail/CVE-2026-47067) is an atom table exhaustion vulnerability
Hackney has unbounded buffer accumulation in WebSocket
CVE-2026-47073
### Summary The WebSocket client in `src/hackney_ws.erl` imposes no upper bound on memory consumption across three dist
Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM
CVE-2026-47074
### Summary `hackney_h3:await_response_loop/6` in `src/hackney_h3.erl` accumulates the HTTP/3 response body in memory w
Hackney: `ssl:connect/2` post-handshake upgrade has no timeout
CVE-2026-47071
### Summary The SOCKS5 transport in `src/hackney_socks5.erl` correctly applies the caller-supplied timeout to the SOCKS
Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry
CVE-2026-47066
### Summary [CVE-2026-47066](https://nvd.nist.gov/vuln/detail/CVE-2026-47066) is an infinite loop (CWE-835) in hackney'
Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication
CVE-2026-49357
# Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication ## Summary `line-desktop-mcp` s
php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
CVE-2026-49260
### Summary `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `es
Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio...
CVE-2026-50741
Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt(...
CVE-2026-48933
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2Gi
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...
CVE-2026-48618
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable...
CVE-2026-9219
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derive
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5...
CVE-2026-9221
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request si
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests...
CVE-2026-9220
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and i
vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability
CVE-2026-22879
vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability
The WebSocket Application Programming Interface lacks restrictions on the number of...
CVE-2026-50176
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without...
CVE-2026-12992
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.ws
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization...
CVE-2026-11800
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an a
picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell...
CVE-2025-71340
picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a...
CVE-2026-12975
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without ena