A2A Java SDK has a fail-open default task authorization
CVE-2026-111764
Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block
#severity:high
共收录 5396 条相关情报。
← 返回所有主题Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
CVE-2026-112397
### Summary A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passi
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-112400
``` ============================================================================ GIF seek keeps rejected size after Deco
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
CVE-2026-112897
``` ============================================================================ TiffDecode returns uninitialized memory
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
CVE-2026-112896
## Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an a
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
CVE-2026-112895
### Summary When an application appends to an existing PDF with `Image.save(..., format="PDF", append=True)`, Pillow par
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
CVE-2026-112404
``` ============================================================================ OOB read in TiffDecode.c tile and RGBA
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
CVE-2026-111758
### Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with defaul
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
CVE-2026-111770
### Summary In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
CVE-2026-111768
### Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one
AIOHTTP: File descriptor exhaustion in multipart requests
CVE-2026-111066
### Summary An attacker can exhaust file descriptors with specially crafted multipart requests. ### Impact If a handl
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
CVE-2026-112942
### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On W
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream...
CVE-2026-105299
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstrea
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent...
CVE-2026-17518
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrup
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to...
CVE-2026-102438
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code wit
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow...
CVE-2026-77935
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenti
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin...
CVE-2026-77926
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating s
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running...
CVE-2026-77938
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server sec
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to...
CVE-2026-77937
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers...
CVE-2026-77930
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell comman