Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for...
CVE-2020-37288
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal functi
#severity:medium
共收录 5506 条相关情报。
← 返回所有主题Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function...
CVE-2021-48019
Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such...
CVE-2020-37289
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function...
CVE-2026-113706
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/
Cachet has Stored XSS in Incident Component
CVE-2026-113712
### Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenti
A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure
CVE-2026-111762
### *Impact.** Push notification bearer tokens and authentication credentials submitted by clients are written to server
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
CVE-2026-111761
--- - **Ecosystem:** Maven - **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (push-notification d
A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
CVE-2026-111763
*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrar
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
CVE-2026-112899
``` ============================================================================ EPS load(scale) lets Ghostscript render
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
CVE-2026-112395
### Summary Pillow's libImaging `_decodeTile` decoder, used to decode tiled TIFF images, allocates a per-tile buffer us
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
CVE-2026-111753
An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37)
AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111748
### Summary An attacker sending an absolute-form request can spoof the scheme used. ### Impact If user code depends o
AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111065
### Summary An overflow in Max-Age processing can skip closing a connection. ### Impact An attacker may be able to ex
AIOHTTP: Pure-Python parser request smuggling
CVE-2026-111750
### Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. ### Impact If users are using t
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE-2026-112944
### Summary `launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI fl
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
CVE-2026-111771
### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issue
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized...
CVE-2026-75753
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send speci
An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0...
CVE-2026-12489
An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.4
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from...
CVE-2026-105298
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-
LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants...
CVE-2026-109441
LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on