undici vulnerable to CRLF Injection via blob-like body 'type' property
CVE-2026-15157
### Impact When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via `request()`, `st
#severity:medium
共收录 5494 条相关情报。
← 返回所有主题undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
CVE-2026-14643
## Impact Undici's cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cach
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-16729
## Impact The `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons
undici vulnerable to downstream response desynchronization via retry interceptor
CVE-2026-16728
### Impact Undici's `interceptors.retry()` can deliver a response whose body length does not match the `Content-Length`
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
CVE-2026-69153
## Summary The fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restric
Russh: Channel-scoped server callbacks can be reached without an open channel
CVE-2026-68930
There is a server-side channel state issue in `russh`. After a client is authenticated, `russh` can dispatch channel-sc
In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from...
CVE-2026-58063
In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue al
A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability...
CVE-2026-18582
A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Re
BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a...
CVE-2026-65875
BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens
In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and...
CVE-2026-59648
In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also aff
In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.
CVE-2026-59652
In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.
In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count....
CVE-2026-59647
In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects
In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from...
CVE-2026-15055
In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also a
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the...
CVE-2026-68583
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field th
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site...
CVE-2026-12231
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_info
A flaw was found in the keycloak-services component of Keycloak, which is used for managing...
CVE-2026-18573
A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authoriza
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services...
CVE-2026-18570
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This componen
Keycloak provides authorization services that allow administrators to restrict access to...
CVE-2026-18572
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policie
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions...
CVE-2026-18571
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled.
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url...
CVE-2026-67352
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows