python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
CVE-2026-53537
### Summary `parse_options_header` parsed `Content-Disposition` (and `Content-Type`) headers with [`email.message.Messa
#severity:low
共收录 1569 条相关情报。
← 返回所有主题DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
## Impact A DOMPurify instance that is reused across trust boundaries can stay bound to a previously supplied `TRUSTED_
OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu...
CVE-2026-53835
OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that
A weakness has been identified in CodeAstro Human Resource Management System 1.0. This...
CVE-2026-12131
A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the functio
OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session...
CVE-2026-53826
OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes th
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Affected by...
CVE-2026-12129
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Affected by this issue is some unknown
A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This...
CVE-2026-12130
A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of t
esbuild allows arbitrary file read when running the development server on Windows
### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir
TYPO3 CMS has Broken Access Control in its File Abstraction Layer
CVE-2026-49738
### Problem The path allowance check in `GeneralUtility::isAllowedAbsPath()` performed a plain string prefix comparison
Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115...
CVE-2026-12032
Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a...
CVE-2026-12017
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had co
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and...
CVE-2026-41694
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses withou
PhoenixStorybook has cross-session PubSub topic injection via URL parameter
CVE-2026-47068
### Summary The storybook iframe LiveView accepts a PubSub topic from the URL query string and broadcasts its own pid on
Net::IMAP: Denial of Service via incomplete raw argument validation
CVE-2026-47241
### Summary Several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection a
Under certain conditions, when an unauthorized attacker accesses a specific endpoint, SAP...
CVE-2026-44743
Under certain conditions, when an unauthorized attacker accesses a specific endpoint, SAP Business Objects application l
A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function...
CVE-2026-11621
A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /adm
A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an...
CVE-2026-11619
A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file
Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827...
CVE-2026-11691
Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote att
Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who...
CVE-2026-11675
Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the re
Insufficient validation of untrusted input in Dawn in Google Chrome on macOS prior to 149.0.7827...
CVE-2026-11686
Insufficient validation of untrusted input in Dawn in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote at