TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN...
CVE-2026-102294
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted
#severity:high
共收录 5417 条相关情报。
← 返回所有主题Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect...
CVE-2026-9032
Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interfa
The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...
CVE-2026-68496
The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when d
Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect...
CVE-2026-78578
Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setu
An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind...
CVE-2026-104018
An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 all version
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker...
CVE-2026-102369
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption...
CVE-2023-54404
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows atta
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent r...
### Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by comm
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
CVE-2026-92950
### Summary The `vm2` command-line tool installed by `npm install -g vm2` and documented in the README's "CLI" section r
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
CVE-2026-92958
## Summary NodeVM's builtin wildcard policy can allow sandboxed code to access `fs/promises` even when the embedder den
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
CVE-2026-102831
## Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses cl
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)
CVE-2026-89425
## Status **FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a 20,000,109-character
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()
CVE-2026-89407
## Status **FULLY REPRODUCED** with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for
devalue: `stringify`/`uneval` serialize shared memory
CVE-2026-92708
### Impact `stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view. I
devalue: Repeated primitive strings cause quadratic expansion in uneval
Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promi
Pexip Infinity before 41.0 is affected by improper input validation in the signaling...
CVE-2026-103102
Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remot
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in...
CVE-2026-103104
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementati
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for...
CVE-2026-96649
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stor
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in...
CVE-2026-103109
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementati