OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree

### Summary The `@typespec/openapi3` emitter retains the value of a `@versioned` enum member and interpolates it into t

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to Denial of Service via crafted multipart field names

CVE-2026-77078

### Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a sing

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

CVE-2026-77037

### Impact A vulnerability in multer `2.2.0` allows an attacker to trigger a Denial of Service (DoS) by aborting or tru

历史摘要 · 未重新核验 · GitHub Advisory

multer vulnerable to Denial of Service via oversized array index in field names

CVE-2026-82333

### Impact multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `a

历史摘要 · 未重新核验 · GitHub Advisory

Windows ML CLI: CORS misconfig enables localhost RCE

CVE-2026-84452

Case Description: MSRC Notes: Attachments: 1 file(s) attached (1 mp4) Summary: The vulnerability lies in the 'serve/cli

历史摘要 · 未重新核验 · GitHub Advisory

mongodb: Reject "." and NUL bytes in database and collection names

CVE-2026-81525

### Impact Passing untrusted input as part of a database or collection name may result in targeting a different database

历史摘要 · 未重新核验 · GitHub Advisory

Composer arbitrary command execution via a malicious package's Perforce source URL

CVE-2026-84361

## Summary If the `p4` Perforce CLI client is installed, a malicious dependency package from a package repository allow

历史摘要 · 未重新核验 · GitHub Advisory

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

### Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in

历史摘要 · 未重新核验 · GitHub Advisory

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

CVE-2026-84375

## Summary `maxTotalMergeKeys` does not count empty mappings. An attacker can repeatedly merge a large sequence of them

历史摘要 · 未重新核验 · GitHub Advisory

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

## Summary `@tiptap/core` contains two quadratic regular-expression denial-of-service paths in its default Markdown att

历史摘要 · 未重新核验 · GitHub Advisory

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

CVE-2026-84445

A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:a

历史摘要 · 未重新核验 · GitHub Advisory

SVGO: removeScripts allows executable links through namespace and control-character bypasses

CVE-2026-84370

## Summary SVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors

历史摘要 · 未重新核验 · GitHub Advisory

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

CVE-2026-83616

## Summary `Document.createProcessingInstruction()` in `@xmldom/xmldom` performs no validation on the `target` paramete

历史摘要 · 未重新核验 · GitHub Advisory

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

CVE-2026-83617

## Summary An embedded line terminator bypasses the `requireWellFormed` serializer check for element and attribute name

历史摘要 · 未重新核验 · GitHub Advisory

xmldom: DocType `name` Injection Bypasses requireWellFormed

CVE-2026-83608

## Summary The `@xmldom/xmldom` serializer emits `DocumentType.name` verbatim into the `` declaration with no well-form

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK...

CVE-2026-86509

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serv

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function...

CVE-2026-86510

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2T

历史摘要 · 未重新核验 · GitHub Advisory

Missing authentication for a critical function in ASUS Control Center Express Agent allows an...

CVE-2026-19397

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby use

历史摘要 · 未重新核验 · GitHub Advisory

SAP NetWeaver Business Client does not perform sufficient validation when processing certain...

CVE-2026-76967

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during

历史摘要 · 未重新核验 · GitHub Advisory

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to...

CVE-2026-66767

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted p

历史摘要 · 未重新核验 · GitHub Advisory