brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
CVE-2026-102277
### Summary Expanding `{a},b}`-shaped input takes time quadratic in the number of literal `}` characters, blocking the
#severity:medium
共收录 5477 条相关情报。
← 返回所有主题Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
## Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
CVE-2026-102265
## Package pyjwt (PyPI) ## Affected versions tested & verified on: 2.13.0. Every version whose `PyJWS._load()` transl
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
CVE-2026-102269
## Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alph
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
CVE-2026-101917
Summary CVE-2026-48524 (GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid v
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
### Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list,
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
### Summary adm-zip enforces a `maxOutputLength` guard against decompression bombs on its synchronous `getData()` path,
Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-102342
The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it. ```sv
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
## Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | `nodemailer` | | Repository | https:
GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN...
CVE-2026-102372
GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthe
GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP...
CVE-2026-102374
GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that doub
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the...
CVE-2026-101280
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this...
CVE-2026-101281
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function op
A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This...
CVE-2026-101279
A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown func
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh...
CVE-2026-102367
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront...
CVE-2026-102364
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authentica
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController...
CVE-2026-102363
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted...
CVE-2026-101277
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the functio
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive...
CVE-2026-102332
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as...
CVE-2026-102333
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web