pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding
CVE-2026-119194
### Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container
#severity:high
共收录 5396 条相关情报。
← 返回所有主题Forge: Regular expression denial of service in PEM decoding (pem.decode)
CVE-2026-118779
### Summary `pem.decode()`, which every node-forge API that parses PEM input uses, split messages with a regular express
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
CVE-2026-118782
### Summary forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero (or less) from the input, and t
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
CVE-2026-119188
### Summary A connection created with `forge.tls.createConnection()` throws an uncaught `TypeError` from `process()` wh
Forge: Denial of service in TLS record processing via call stack exhaustion
CVE-2026-119187
### Summary Connections created with `forge.tls.createConnection()` processed received TLS records recursively, one sta
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
CVE-2026-119190
### Summary node-forge parses certificate extensions with the deprecated OIDs `2.5.29.10` and `2.5.29.13` as `basicConst
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation
CVE-2026-116794
### Summary The agent server in `russh::keys::agent::server` never calls `Agent::confirm` before signing with a key tha
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
CVE-2026-118669
## Summary OAuthlib's token grant handlers can authenticate one client while authorizing the grant type and requested s
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
### Summary Out-of-bounds heap write in imgproxy's ICO loader (`vips/icoload.c`): when the ICO entry's image data buffe
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
### Summary Unbounded and unvalidated memory allocation in imgproxy's ICO loader (`vips/icoload.c`). An attacker-contro
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
CVE-2026-96633
## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process thro
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
CVE-2026-96631
### Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forw
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
CVE-2026-96632
## Summary AdminNeo inserts the database server's version string into a `` tag that carries a valid CSP nonce, without
AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
CVE-2026-96630
## Summary Adminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in...
CVE-2026-16760
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class throug...
CVE-2026-118938
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Val
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billi...
CVE-2026-111578
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape sev
Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the ...
CVE-2026-78402
Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overf
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// U...
CVE-2026-116252
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq tre
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it ...
CVE-2026-116250
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permissio