Tanium addressed a path traversal vulnerability in Tanium Data Service.

CVE-2026-14505

Tanium addressed a path traversal vulnerability in Tanium Data Service.

历史摘要 · 未重新核验 · GitHub Advisory

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function...

CVE-2026-87083

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from

历史摘要 · 未重新核验 · GitHub Advisory

Tanium addressed an improper access controls vulnerability in Comply.

CVE-2026-87019

Tanium addressed an improper access controls vulnerability in Comply.

历史摘要 · 未重新核验 · GitHub Advisory

Tanium addressed an improper access controls vulnerability in Tanium Server.

CVE-2026-14892

Tanium addressed an improper access controls vulnerability in Tanium Server.

历史摘要 · 未重新核验 · GitHub Advisory

Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which...

CVE-2026-87724

Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attacker

历史摘要 · 未重新核验 · GitHub Advisory

Tanium addressed an information disclosure vulnerability in Tanium Server.

CVE-2026-87032

Tanium addressed an information disclosure vulnerability in Tanium Server.

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy

CVE-2026-86996

## Impact A workflow's "_This workflow can be called by_" setting was enforced by the Execute Workflow node but was not

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

### Summary Nodemailer resolves an international (IDN / non-ASCII) recipient **domain** to a different Punycode `xn--`

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

### Summary Nodemailer's email-address parser treats an **RFC 5322 comment** `( ... )` inside the domain as a point to

历史摘要 · 未重新核验 · GitHub Advisory

morgan vulnerable to Log Forging via unescaped Unicode line separators

CVE-2026-15603

### Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutrali

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

CVE-2026-84376

## Summary Astro stripped a configured `base` path from request pathnames using a string-prefix check that did not veri

历史摘要 · 未重新核验 · GitHub Advisory

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

CVE-2026-84308

The pure-PHP X25519 scalar multiplication in phpseclib is not constant-time. Field addition and subtraction each perform

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

CVE-2026-84365

### Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. `toSSG()` can still write file

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

CVE-2026-84364

### Summary When `parseBody()` expands dot-separated form field names into nested objects, it does not limit the nestin

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

CVE-2026-84363

### Summary Hono's query parsing does not stop at the URL fragment: a `?` appearing after a `#` is treated as the start

历史摘要 · 未重新核验 · GitHub Advisory

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

CVE-2026-84369

## Summary SVGO's opt-in `removeScripts` plugin did not inspect executable HTML content inside SVG `` elements. Applica

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

### Summary Nodemailer's `disableFileAccess` / `disableUrlAccess` options are a security sandbox that lets an applicati

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability...

CVE-2026-86513

A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function Tr

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this...

CVE-2026-86511

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDe

历史摘要 · 未重新核验 · GitHub Advisory

Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to...

CVE-2026-75809

Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and d

历史摘要 · 未重新核验 · GitHub Advisory