Crass: Non-ASCII characters cause superlinear CPU consumption

CVE-2026-61848

### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of m

来源摘录 · GitHub Advisory

Crass: A large number of adjacent CSS comments can trigger a SystemStackError

CVE-2026-61847

### Impact When the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comm

来源摘录 · GitHub Advisory

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

CVE-2026-61846

### Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value

来源摘录 · GitHub Advisory

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

CVE-2026-55186

### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password a

来源摘录 · GitHub Advisory

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From hea...

CVE-2026-66912

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Cla

来源摘录 · NVD / GitHub Advisory

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, ...

CVE-2026-66911

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due

来源摘录 · NVD / GitHub Advisory

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read produ...

CVE-2026-114173

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefron

来源摘录 · NVD / GitHub Advisory

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the...

CVE-2026-113409

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to store

来源摘录 · NVD / GitHub Advisory

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component ...

CVE-2026-118590

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_

来源摘录 · NVD / GitHub Advisory

A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in s...

CVE-2026-118586

A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the fi

来源摘录 · NVD / GitHub Advisory

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

CVE-2026-115927

### Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have

来源摘录 · GitHub Advisory

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

CVE-2026-116577

### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obs

来源摘录 · GitHub Advisory

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

CVE-2026-116695

## Summary Crass's tokenizer didn't terminate a bad URL token at a `)` that followed an escaped backslash (`\\`). As a

来源摘录 · GitHub Advisory

Backstage catalog rules can be bypassed for URL locations using encoded path segments

CVE-2026-115923

## Summary `@backstage/plugin-catalog-backend` matches URL-type locations against `catalog.rules` location patterns usi

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Vide...

CVE-2026-118537

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catal

来源摘录 · NVD / GitHub Advisory

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

## ⚠️ Update (verification, 2026-05-19): C-2 confirmed end-to-end — **4.5× amplification observed** (worse than the advi

历史摘要 · 未重新核验 · GitHub Advisory

Waline login accepts a non-string email as a match-all MongoDB query

## Summary The login endpoint POST /api/token reads the `email` field from the request body without checking its type a

历史摘要 · 未重新核验 · GitHub Advisory

Seroval: Code injection through a typed array's own constructor property

CVE-2026-116583

### Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in th

历史摘要 · 未重新核验 · GitHub Advisory

Seroval: Script injection through RegExp sources in serialized output

CVE-2026-116582

### Summary seroval writes a `RegExp` as a regular expression literal. In affected versions, the `` element that the se

历史摘要 · 未重新核验 · GitHub Advisory

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

CVE-2026-116575

Summary _build_session_scope() in mem0/memory/main.py builds the conversation-history scope key used to fetch/store the

历史摘要 · 未重新核验 · GitHub Advisory