Excon does not redact additional sensitive/risky headers when following redirects
CVE-2026-54171
### Impact The redirect follower middleware previously failed to strip a number of headers that are known to be sensitiv
#severity:medium
共收录 5559 条相关情报。
← 返回所有主题Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
CVE-2026-54163
## Summary `secure_headers` builds the `Content-Security-Policy` value by stitching every configured directive together
Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search
CVE-2026-54136
### Summary A resource-scoped API token can read script contents outside its allowed path scope via `GET /api/w/{worksp
SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon
CVE-2026-54068
### Summary The `/api/icon/getDynamicIcon` endpoint is explicitly excluded from authentication in SiYuan's kernel route
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
### Summary CredSweeper's deep scanner does not enforce `recursive_limit_size` as a hard limit. Several recursive scanne
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker...
CVE-2026-57476
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additio
Deloitte AI Assist for Customer disclosed some configuration information through public-facing...
CVE-2026-57474
Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accept
MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
### Summary GHSA-7r34-79r5-rcc9's fix added `validate_url_for_ssrf`, which resolves the attacker-controlled `X-Atlassian
tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
CVE-2026-49977
### Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with dat
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
CVE-2026-49865
### Summary Kimai 2.56.0 contains a server-side request forgery vulnerability in its invoice PDF preview and generation
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
CVE-2026-5078
### Impact Morgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the...
CVE-2026-15319
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function IPAllowlist of the
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding...
CVE-2026-57031
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper N
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows...
CVE-2026-58144
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users wi
A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of...
CVE-2026-57054
A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS o
A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of...
CVE-2026-57024
A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos O
An Out-of-bounds Write vulnerability in the http-gatekeeper (http-gk) of Juniper Networks Junos...
CVE-2026-57021
An Out-of-bounds Write vulnerability in the http-gatekeeper (http-gk) of Juniper Networks Junos OS on SRX Series allows
A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos...
CVE-2026-57029
A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series
A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of...
CVE-2026-57025
A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper...
CVE-2026-57028
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolve