rust-zserio has Unbounded Memory Allocation
### Impact When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and th
#severity:high
共收录 5513 条相关情报。
← 返回所有主题Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)
CVE-2026-44504
## Impact Aegra deployments running 0.9.0 through 0.9.6 with multiple authenticated users on a shared instance are vuln
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
CVE-2026-44503
### Summary The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9
Rancher Extensions have arbitrary file access via path traversal
CVE-2026-25705
### Impact A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integr
Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure
### Summary [Amazon Elastic Container Service (Amazon ECS)](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/
Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine
CVE-2026-42594
## Summary The webhook middleware spawns a goroutine that holds a reference to the request's `echo.Context` after the s
Gotenberg has a Server-Side Request Forgery (SSRF) Issue
CVE-2026-42591
### Summary The SSRF hardening shipped in v8.31.0 only covers outbound URLs that Gotenberg's Go code handles — Chromium
Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist
CVE-2026-42590
**Summary** The ExifTool metadata write blocklist in Gotenberg v8 can be bypassed using ExifTool's group-prefix syntax,
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
CVE-2026-42587
## Summary `HttpContentDecompressor` accepts a `maxAllocation` parameter to limit decompression buffer size and prevent
Netty has HttpClientCodec response desynchronization
CVE-2026-42584
### Summary If HttpClientCodec is configured, there are use cases when a response body from one request, can be parsed
Netty Lz4FrameDecoder is vulnerable to resource exhaustion
CVE-2026-42583
### Summary Lz4FrameDecoder allocates a ByteBuf of size `decompressedLength` (up to 32 MB per block) before LZ4 runs. A
Netty HTTP/3 QPACK literal unbounded allocation
CVE-2026-42582
### Summary When Netty decodes HTTP/3 headers, it sometimes runs `new byte[length]` using a length from the wire before
Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)
CVE-2026-42579
# Security Vulnerability Report: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) ## 1. Vulnerability Sum
gix-fs: Symlink prefix-reuse allows worktree escape during checkout
CVE-2026-44471
### Summary A malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-c
ldap3_proto has LDAP Filter stack exhaustion
### Impact LDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack.
scim_proton and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion
### Summary A single unauthenticated `GET` to any `/scim/v1/...` endpoint with a `?filter=` query string of a few thous
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of...
CVE-2025-71254
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additio
In IMS, there is a possible system crash due to improper input validation. This could lead to...
CVE-2025-71251
In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service w
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of...
CVE-2025-71253
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additio
In nr modem, there is a possible improper input validation. This could lead to remote denial of...
CVE-2025-71256
In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no addition