Nerdbank.MessagePack has a memory amplification DoS in collection deserialization
Nerdbank.MessagePack deserializers for many collection-shaped types trusted the element count declared in MessagePack ar
#severity:medium
共收录 5624 条相关情报。
← 返回所有主题Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection
CVE-2026-47122
## Summary AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data i
Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta
CVE-2026-47121
## Summary Binary delta apply intermediate-symlink traversal in malicious .delta `Autoupdate/SUBinaryDeltaApply.m` enf
go-git: Malformed Git object data may cause panics or resource exhaustion
### Impact Several denial-of-service issues were identified in `go-git` when parsing maliciously crafted Git repository
russh server userauth state is not reset when authentication principal changes
CVE-2026-46705
### Summary The `russh` server authentication path keeps internal userauth state across `SSH_MSG_USERAUTH_REQUEST` messa
uv is vulnerable to arbitrary file write through entry point names
### Impact In versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (
Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers
CVE-2026-47248
### Impact Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through `Did you mean .
tar has a PAX header desynchronization issue
### Summary When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (
astral-tokio-tar has a PAX Header Desynchronization issue
### Impact Versions of astral-tokio-tar prior to 0.6.2 contain a PAX header interpretation bug that allows manipulated
unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race
CVE-2026-46690
## Summary `Sender::send` in `src/lib.rs` contains an `unsafe` block in the `DISCONNECTED` arm that transmutes a **raw
CAPM3 vulnerable to Cross-Namespace resource access
## Summary CAPM3 is Metal3's Cluster API (CAPI) provider for baremetal provisioning in Kubernetes. Multiple cross-names
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for...
CVE-2026-4888
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
CVE-2026-45703
### Summary The `WordExport` export flow only checks whether the current backend user has the feature permission `word_
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
CVE-2026-45309
## Summary AsyncSSH 2.22.0 expands the OpenSSH-compatible `AuthorizedKeysFile` `%u` token with the raw SSH username duri
ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of...
CVE-2026-9759
ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of service
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions...
CVE-2026-21785
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlie
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7,...
CVE-2026-1402
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, an
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.10.7, 18...
CVE-2026-5296
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.10.7, 18.11 before 18.11.4, and 1
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7,...
CVE-2026-6713
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, an
GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18...
CVE-2026-2601
GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 1