An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix...

CVE-2026-44029

An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "n

历史摘要 · 未重新核验 · GitHub Advisory

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

CVE-2026-42037

### Summary The `FormDataPart` constructor in `lib/helpers/formDataToStream.js` interpolates `value.type` directly into

历史摘要 · 未重新核验 · GitHub Advisory

Axios: no_proxy bypass via IP alias allows SSRF

CVE-2026-42038

The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 12

历史摘要 · 未重新核验 · GitHub Advisory

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

CVE-2026-42039

### Summary toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request

历史摘要 · 未重新核验 · GitHub Advisory

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

CVE-2026-42034

### Summary For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https trans

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in A-G-U-P-T-A wireshark-mcp...

CVE-2026-7785

A security flaw has been discovered in A-G-U-P-T-A wireshark-mcp edaf604416fbc94a201b4043092d4a1b09a12275/400c3da70074f2

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to...

CVE-2026-7788

A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The af

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability has been found in RTGS2017 NagaAgent up to 5.1.0. This issue affects some unknown...

CVE-2026-7784

A vulnerability has been found in RTGS2017 NagaAgent up to 5.1.0. This issue affects some unknown processing of the file

历史摘要 · 未重新核验 · GitHub Advisory

Axios: HTTP adapter streamed responses bypass maxContentLength

CVE-2026-42036

### Summary When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength.

历史摘要 · 未重新核验 · GitHub Advisory

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

CVE-2026-42042

# Vulnerability Disclosure: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Co

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

CVE-2026-42041

# Vulnerability Disclosure: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy ##

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

CVE-2026-42044

# Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` ## Summa

历史摘要 · 未重新核验 · GitHub Advisory

ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key

## Summary Between 2026-02 and 2026-04-24 a total of 22 public PyPI sdists of `ogham-mcp` contained development credent

历史摘要 · 未重新核验 · GitHub Advisory

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

CVE-2026-42312

### Summary The `set_config_value()` API method (`@permission(Perms.SETTINGS)`) in `src/pyload/core/api/__init__.py` ga

历史摘要 · 未重新核验 · GitHub Advisory

net-imap vulnerable to command Injection via "raw" arguments to multiple commands

CVE-2026-42257

### Summary Several `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or e

历史摘要 · 未重新核验 · GitHub Advisory

net-imap vulnerable to command Injection via unvalidated Symbol inputs

CVE-2026-42258

### Summary Symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol argumen

历史摘要 · 未重新核验 · GitHub Advisory

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

CVE-2026-42256

### Summary When authenticating a connection with `SCRAM-SHA1` or `SCRAM-SHA256`, a hostile server can perform a comput

历史摘要 · 未重新核验 · GitHub Advisory

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

CVE-2026-42576

`DiscoverKeys` in `pkg/apk/apk/implementation.go` unconditionally type-asserts JWKS keys as `*rsa.PublicKey` without che

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration

## Summary The `GET /api/station/{station_id}/file/{id}/play` endpoint, handled by `PlayAction`, is missing the `Middle

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption

## Summary The `/api/internal/{station_id}/liquidsoap/{action}` endpoint is accessible from the public web interface be

历史摘要 · 未重新核验 · GitHub Advisory