Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

CVE-2026-44456

## Summary `bodyLimit()` does not reliably enforce `maxSize` for requests without a usable `Content-Length` (e.g. `Tran

历史摘要 · 未重新核验 · GitHub Advisory

hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

CVE-2026-44455

## Summary Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted

历史摘要 · 未重新核验 · GitHub Advisory

Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users

## Summary The unauthenticated resend-verification endpoint returns different responses for registered and unregistered

历史摘要 · 未重新核验 · GitHub Advisory

Playwright Capture permits access to local files and internal network resources during page capture

CVE-2026-44439

Playwright Capture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attac

历史摘要 · 未重新核验 · GitHub Advisory

Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

CVE-2026-44437

### Description A vulnerability exists in the `X-Forwarded-Prefix` header processing logic within Angular SSR. The inter

历史摘要 · 未重新核验 · GitHub Advisory

kanidmd_lib: Image upload validators run before authorization; PNG validator panics on malformed input

### Summary The `POST /v1/domain/_image` and `POST /v1/oauth2/{rs_name}/_image` handlers call `validate_image()` on the

历史摘要 · 未重新核验 · GitHub Advisory

Kanidm: Stored HTML injection in "passkey-enrolment" partial via displayname → htmx-driven authenticated request forgery

### Summary The kanidmd web UI renders the WebAuthn passkey-registration challenge as raw JSON inside an inline `` elem

历史摘要 · 未重新核验 · GitHub Advisory

ShellHub has crash-DoS via field injection in filter and sort-by parameters

CVE-2026-44425

## Summary The device list endpoint accepts user-controlled identifiers in two places that are passed directly as BSON/S

历史摘要 · 未重新核验 · GitHub Advisory

@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening

## Summary Two related permission defects in this AxonFlow plugin allowed registration credentials and cache state to b

历史摘要 · 未重新核验 · GitHub Advisory

ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data

CVE-2026-44423

## Summary `GET /api/sessions/:uid` returns the full session object for any authenticated caller, without scoping by the

历史摘要 · 未重新核验 · GitHub Advisory

ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace

CVE-2026-44424

## Summary `GET /api/devices/:uid` returns the full device object whenever the caller is authenticated, without verifyin

历史摘要 · 未重新核验 · GitHub Advisory

axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

## Summary The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key ret

历史摘要 · 未重新核验 · GitHub Advisory

axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

## Summary The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key ret

历史摘要 · 未重新核验 · GitHub Advisory

axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

## Summary The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key ret

历史摘要 · 未重新核验 · GitHub Advisory

axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

## Summary The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key ret

历史摘要 · 未重新核验 · GitHub Advisory

An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in...

CVE-2026-7572

An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor befor

历史摘要 · 未重新核验 · GitHub Advisory

An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor...

CVE-2026-7573

An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 a

历史摘要 · 未重新核验 · GitHub Advisory

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

CVE-2026-44222

## Summary This report explains a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-o

历史摘要 · 未重新核验 · GitHub Advisory

ciguard: SCA HTTP client reads response body without size cap

CVE-2026-44219

## Summary Both SCA HTTP clients (`src/ciguard/analyzer/sca/osv.py` and `src/ciguard/analyzer/sca/endoflife.py`) call `

历史摘要 · 未重新核验 · GitHub Advisory

sse-channel: SSE Injection via unsanitized event fields

CVE-2026-44217

### Impact Implementations that allows user-provided values to be passed to `event`, `retry` or `id` fields would be su

历史摘要 · 未重新核验 · GitHub Advisory