guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the...
CVE-2026-67353
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimit
#severity:medium
共收录 5494 条相关情报。
← 返回所有主题better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to...
CVE-2026-67333
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redi
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored...
CVE-2026-67335
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to vali
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the...
CVE-2026-67332
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin,...
CVE-2026-67334
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endp
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers...
CVE-2026-67339
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cUR
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request...
CVE-2026-67319
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing...
CVE-2026-67321
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level k
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit...
CVE-2026-67318
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bo
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing...
CVE-2026-67313
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names wi
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction...
CVE-2026-67316
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype h
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that...
CVE-2026-67308
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execut
axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in...
CVE-2026-67315
axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing re
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled...
CVE-2026-67312
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream...
CVE-2026-67317
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch a
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth...
CVE-2026-67314
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/a
OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object...
CVE-2026-67310
OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in t
FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection...
CVE-2026-67295
FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in...
CVE-2026-67302
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redire