docker.io/litefuse/litefuse-web:26.0.1 linux/amd64

docker.io/litefuse/litefuse-web:26.0.1 - Trivy安全扫描结果扫描时间: 2026-07-23 18:24

全部漏洞信息

低危漏洞:21

中危漏洞:130

高危漏洞:124

严重漏洞:11

系统OS: alpine 3.24.1 扫描引擎: Trivy 扫描时间: 2026-07-23 18:24

docker.io/litefuse/litefuse-web:26.0.1 (alpine 3.24.1) (alpine)

低危漏洞:0

中危漏洞:0

高危漏洞:0

严重漏洞:0

软件包	漏洞	安全状态	安装版本	修复版本	漏洞信息

Node.js (node-pkg)

低危漏洞:16

中危漏洞:87

高危漏洞:77

严重漏洞:6

软件包	漏洞	安全状态	安装版本	修复版本	漏洞信息
fast-xml-parser	CVE-2026-25896	严重	4.4.1	5.3.5, 4.5.4	fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25896 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-20 21:19 修改: 2026-07-21 12:17
protobufjs	CVE-2026-41242	严重	7.4.0	8.0.1, 7.5.5	protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41242 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-18 17:16 修改: 2026-07-15 02:21
protobufjs	CVE-2026-41242	严重	7.5.4	8.0.1, 7.5.5	protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41242 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-18 17:16 修改: 2026-07-15 02:21
shell-quote	CVE-2026-9277	严重	1.8.3	1.8.4	shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9277 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-22 14:16 修改: 2026-07-22 12:18
tar	CVE-2026-59873	严重	6.2.1	7.5.19	tar: node-tar: Denial of Service via crafted gzip bomb 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59873 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:57
tar	CVE-2026-59873	严重	7.5.13	7.5.19	tar: node-tar: Denial of Service via crafted gzip bomb 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59873 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:57
brace-expansion	CVE-2026-13149	高危	2.0.1	5.0.7, 1.1.16, 2.1.2	brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
brace-expansion	CVE-2026-13149	高危	5.0.5	5.0.7, 1.1.16, 2.1.2	brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
cross-spawn	CVE-2024-21538	高危	7.0.3	7.0.5, 6.0.6	cross-spawn: regular expression denial of service 漏洞详情: https://avd.aquasec.com/nvd/cve-2024-21538 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2024-11-08 05:15 修改: 2026-06-17 07:09
dd-trace	CVE-2026-50272	高危	5.65.0	5.100.0	dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50272 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-17 21:17 修改: 2026-07-21 04:16
effect	CVE-2026-32887	高危	3.16.12	3.20.0	Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32887 镜像层: sha256:40f443832c40e818732d7ae127c608748c17ec3b58622ed6e707859e05ce80bf 发布日期: 2026-03-20 22:16 修改: 2026-06-17 10:36
fast-uri	CVE-2026-13676	高危	3.0.6	4.0.1, 3.1.3, 2.4.2	fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13676 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-29 14:16 修改: 2026-07-22 12:17
fast-uri	CVE-2026-16221	高危	3.0.6	2.4.3, 3.1.4, 4.1.1	Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ... 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-16221 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-19 15:16 修改: 2026-07-21 18:31
fast-uri	CVE-2026-6321	高危	3.0.6	3.1.1	fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6321 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-04 20:16 修改: 2026-07-21 12:19
fast-uri	CVE-2026-6322	高危	3.0.6	3.1.2	fast-uri: fast-uri: URI authority bypass due to improper delimiter handling 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6322 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-05 11:16 修改: 2026-07-22 12:18
@grpc/grpc-js	CVE-2026-48068	高危	1.11.1	1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4	grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48068 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-14 20:17 修改: 2026-07-21 16:17
fast-xml-parser	CVE-2026-26278	高危	4.4.1	4.5.4, 5.3.6	fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26278 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-19 20:25 修改: 2026-07-21 12:17
fast-xml-parser	CVE-2026-33036	高危	4.4.1	5.5.6, 4.5.5	fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33036 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-20 06:16 修改: 2026-06-17 10:36
glob	CVE-2025-64756	高危	10.3.10	11.1.0, 10.5.0	glob: glob: Command Injection Vulnerability via Malicious Filenames 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-64756 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2025-11-17 18:15 修改: 2026-06-17 09:55
js-yaml	CVE-2026-59869	高危	4.1.1	3.15.0, 4.3.0	js-yaml: js-yaml: Denial of Service via crafted YAML documents 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59869 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-08 16:16 修改: 2026-07-13 15:05
kysely	CVE-2026-32763	高危	0.27.4	0.28.12	SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32763 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-20 00:16 修改: 2026-06-17 10:36
kysely	CVE-2026-33468	高危	0.27.4	0.28.14	Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33468 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-26 17:16 修改: 2026-06-17 10:37
kysely	CVE-2026-44635	高危	0.27.4	0.28.17	Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44635 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-27 19:16 修改: 2026-06-17 10:51
lodash	CVE-2026-4800	高危	4.17.23	4.18.0	lodash: lodash: Arbitrary code execution via untrusted input in template imports 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-4800 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-31 20:16 修改: 2026-07-21 12:18
minimatch	CVE-2026-26996	高危	9.0.3	10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3	minimatch: minimatch: Denial of Service via specially crafted glob patterns 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26996 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-02-20 03:16 修改: 2026-06-17 10:26
minimatch	CVE-2026-27903	高危	9.0.3	10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3	minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27903 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
minimatch	CVE-2026-27904	高危	9.0.3	10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4	minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27904 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
minimatch	CVE-2026-26996	高危	9.0.5	10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3	minimatch: minimatch: Denial of Service via specially crafted glob patterns 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26996 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-20 03:16 修改: 2026-06-17 10:26
minimatch	CVE-2026-27903	高危	9.0.5	10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3	minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27903 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
minimatch	CVE-2026-27904	高危	9.0.5	10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4	minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27904 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
next	CVE-2026-44573	高危	15.5.10	15.5.16, 16.2.5	next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44573 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 17:16 修改: 2026-07-16 12:17
next	CVE-2026-44574	高危	15.5.10	15.5.16, 16.2.5	Next.js: Next.js: Authorization bypass via crafted query parameters 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44574 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 17:16 修改: 2026-07-16 12:17
next	CVE-2026-44575	高危	15.5.10	15.5.16, 16.2.5	next.js: Next.js: Unauthorized access to protected content via middleware bypass 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44575 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 17:16 修改: 2026-07-16 12:17
next	CVE-2026-44578	高危	15.5.10	15.5.16, 16.2.5	Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44578 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 18:16 修改: 2026-07-16 12:17
next	CVE-2026-44579	高危	15.5.10	15.5.16, 16.2.5	next.js: Next.js: Denial of Service via crafted POST requests to server actions 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44579 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 18:16 修改: 2026-07-15 02:22
next	CVE-2026-45109	高危	15.5.10	15.5.18, 16.2.6	next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45109 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 18:16 修改: 2026-07-16 12:17
next	CVE-2026-64641	高危	15.5.10	15.5.21, 16.2.11	Next.js: Denial of Service in App Router using Server Actions 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64641 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
next	CVE-2026-64645	高危	15.5.10	15.5.21, 16.2.11	Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64645 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
next	CVE-2026-64649	高危	15.5.10	15.5.21, 16.2.11	Next.js: Server-Side Request Forgery in Server Actions on custom servers 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64649 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
next	GHSA-8h8q-6873-q5fj	高危	15.5.10	15.5.16, 16.2.5	Next.js Vulnerable to Denial of Service with Server Components 漏洞详情: https://github.com/advisories/GHSA-8h8q-6873-q5fj 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-11 14:50 修改: 2026-05-11 14:50
next	GHSA-q4gf-8mx6-v5v3	高危	15.5.10	15.5.15, 16.2.3	Next.js has a Denial of Service with Server Components 漏洞详情: https://github.com/advisories/GHSA-q4gf-8mx6-v5v3 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-10 15:35 修改: 2026-04-10 15:35
nodemailer	GHSA-p6gq-j5cr-w38f	高危	7.0.11	9.0.1	Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message 漏洞详情: https://github.com/advisories/GHSA-p6gq-j5cr-w38f 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-18 14:28 修改: 2026-06-18 14:28
path-to-regexp	CVE-2026-4867	高危	0.1.12	0.1.13	path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-4867 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-26 17:16 修改: 2026-06-17 10:57
picomatch	CVE-2026-33671	高危	4.0.3	4.0.4, 3.0.2, 2.3.2	picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33671 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-26 22:16 修改: 2026-06-17 10:37
pnpm	CVE-2025-69262	高危	9.5.0	10.27.0	pnpm: pnpm: Remote code execution via command injection in tokenHelper environment variable substitution 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-69262 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-01-07 23:15 修改: 2026-06-22 14:39
pnpm	CVE-2025-69263	高危	9.5.0	10.26.0	pnpm: pnpm Lockfile Integrity Bypass 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-69263 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-01-07 22:15 修改: 2026-07-15 02:17
pnpm	CVE-2026-50015	高危	9.5.0	10.34.0, 11.4.0	pnpm: pnpm: Arbitrary file write/delete due to lack of path validation in patch files 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50015 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:15
pnpm	CVE-2026-50016	高危	9.5.0	10.34.0, 11.4.0	pnpm: pnpm: Arbitrary code execution due to path traversal in dependency aliases 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50016 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-29 23:57
pnpm	CVE-2026-55487	高危	9.5.0	10.34.2, 11.5.3	pnpm: pnpm: Supply chain compromise via manipulated package source strings 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-55487 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:16
pnpm	CVE-2026-55697	高危	9.5.0	11.5.3	pnpm: pnpm: Arbitrary code execution via improper handling of config dependencies 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-55697 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-30 19:04
pnpm	CVE-2026-55698	高危	9.5.0	10.34.2, 11.5.3	pnpm: pnpm: Arbitrary code execution via malicious package-manager lockfile 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-55698 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-30 19:03
pnpm	GHSA-72r4-9c5j-mj57	高危	9.5.0	10.34.4, 11.7.0	pnpm: `patch-remove` could delete project-selected files outside the patches directory 漏洞详情: https://github.com/advisories/GHSA-72r4-9c5j-mj57 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-27 00:12 修改: 2026-06-27 00:12
pnpm	GHSA-fr4h-3cph-29xv	高危	9.5.0	10.34.4, 11.7.0	pnpm: Hoisted install imports lockfile alias outside node_modules 漏洞详情: https://github.com/advisories/GHSA-fr4h-3cph-29xv 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-27 00:02 修改: 2026-06-27 00:03
pnpm	GHSA-qrv3-253h-g69c	高危	9.5.0	10.34.4, 11.8.0	pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config 漏洞详情: https://github.com/advisories/GHSA-qrv3-253h-g69c 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-27 00:13 修改: 2026-06-27 00:13
@grpc/grpc-js	CVE-2026-48069	高危	1.11.1	1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4	grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48069 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-14 20:17 修改: 2026-07-15 20:23
protobufjs	CVE-2026-44289	高危	7.4.0	7.5.6, 8.0.2	protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44289 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-07-22 12:18
protobufjs	CVE-2026-44290	高危	7.4.0	7.5.6, 8.0.2	protobufjs: protobufjs: Denial of Service via crafted schema 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44290 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
protobufjs	CVE-2026-44291	高危	7.4.0	7.5.6, 8.0.2	protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44291 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
protobufjs	CVE-2026-44293	高危	7.4.0	7.5.6, 8.0.2	protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44293 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-07-22 12:18
protobufjs	CVE-2026-48712	高危	7.4.0	7.6.1, 8.4.1	protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48712 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-22 18:16 修改: 2026-06-26 20:04
@hono/node-server	CVE-2026-29087	高危	1.19.9	1.19.10	@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-29087 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-06 18:16 修改: 2026-06-17 10:29
protobufjs	CVE-2026-44289	高危	7.5.4	7.5.6, 8.0.2	protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44289 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-07-22 12:18
protobufjs	CVE-2026-44290	高危	7.5.4	7.5.6, 8.0.2	protobufjs: protobufjs: Denial of Service via crafted schema 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44290 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
protobufjs	CVE-2026-44291	高危	7.5.4	7.5.6, 8.0.2	protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44291 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
protobufjs	CVE-2026-44293	高危	7.5.4	7.5.6, 8.0.2	protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44293 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-07-22 12:18
protobufjs	CVE-2026-48712	高危	7.5.4	7.6.1, 8.4.1	protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48712 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-22 18:16 修改: 2026-06-26 20:04
rollup	CVE-2026-27606	高危	4.53.3	2.80.0, 3.30.0, 4.59.0	rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27606 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-25 03:16 修改: 2026-07-20 12:18
serialize-javascript	GHSA-5c6j-r48x-rmvq	高危	6.0.2	7.0.3	Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() 漏洞详情: https://github.com/advisories/GHSA-5c6j-r48x-rmvq 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-28 02:50 修改: 2026-03-02 16:17
sharp	GHSA-f88m-g3jw-g9cj	高危	0.34.5	0.35.0	sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 漏洞详情: https://github.com/advisories/GHSA-f88m-g3jw-g9cj 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-21 22:07 修改: 2026-07-21 22:07
@opentelemetry/propagator-jaeger	CVE-2026-59892	高危	1.26.0	2.9.0	@opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59892 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-08 17:17 修改: 2026-07-10 18:56
shell-quote	CVE-2026-13311	高危	1.8.3	1.9.0	shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13311 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-25 05:16 修改: 2026-06-26 19:03
sigstore	CVE-2026-48815	高危	4.1.0	4.1.1	sigstore: Sigstore: Unauthorized certificates accepted due to ignored `certificateOIDs` verification option 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48815 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-07-14 21:17 修改: 2026-07-15 20:23
@opentelemetry/sdk-node	CVE-2026-44902	高危	0.53.0	0.217.0	opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44902 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-27 15:16 修改: 2026-06-17 10:51
tar	CVE-2026-23745	高危	6.2.1	7.5.3	node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-23745 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-01-16 22:16 修改: 2026-07-21 12:17
tar	CVE-2026-23950	高危	6.2.1	7.5.4	node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-23950 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-01-20 01:15 修改: 2026-07-15 02:18
tar	CVE-2026-24842	高危	6.2.1	7.5.7	node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24842 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-01-28 01:16 修改: 2026-07-15 02:18
tar	CVE-2026-26960	高危	6.2.1	7.5.8	node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26960 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-02-20 02:16 修改: 2026-06-17 10:26
tar	CVE-2026-29786	高危	6.2.1	7.5.10	node-tar: hardlink path traversal via drive-relative linkpath 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-29786 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-03-07 16:15 修改: 2026-07-15 02:19
tar	CVE-2026-31802	高危	6.2.1	7.5.11	tar: tar: File overwrite via drive-relative symlink traversal 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-31802 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-03-10 07:44 修改: 2026-06-17 10:34
tar	CVE-2026-59874	高危	6.2.1	7.5.18	tar: Node-tar: Denial of Service via malformed tar archive header 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59874 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:54
brace-expansion	CVE-2026-13149	高危	2.0.1	5.0.7, 1.1.16, 2.1.2	brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
tar	CVE-2026-59874	高危	7.5.13	7.5.18	tar: Node-tar: Denial of Service via malformed tar archive header 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59874 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:54
undici	CVE-2026-12151	高危	6.25.0	6.27.0, 7.28.0, 8.5.0	undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12151 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-06-17 17:16 修改: 2026-07-21 12:17
next	CVE-2026-64646	中危	15.5.10	15.5.21, 16.2.11	Next.js: Unbounded Server Action payload in Edge runtime 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64646 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
next	CVE-2026-64647	中危	15.5.10	15.5.21, 16.2.11	Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64647 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
next	CVE-2026-64648	中危	15.5.10	15.5.21, 16.2.11	Next.js: Cache confusion of response bodies for requests with bodies 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64648 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
ajv	CVE-2025-69873	中危	8.17.1	8.18.0, 6.14.0	ajv: ReDoS via $data reference 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-69873 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-11 19:15 修改: 2026-07-21 12:17
nodemailer	GHSA-268h-hp4c-crq3	中危	7.0.11	8.0.9	Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection 漏洞详情: https://github.com/advisories/GHSA-268h-hp4c-crq3 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-15 17:36 修改: 2026-06-15 17:36
nodemailer	GHSA-r7g4-qg5f-qqm2	中危	7.0.11	8.0.8	Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception 漏洞详情: https://github.com/advisories/GHSA-r7g4-qg5f-qqm2 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-15 17:34 修改: 2026-06-15 17:34
nodemailer	GHSA-vvjj-xcjg-gr5g	中危	7.0.11	8.0.5	Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) 漏洞详情: https://github.com/advisories/GHSA-vvjj-xcjg-gr5g 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-08 15:05 修改: 2026-04-08 15:05
nodemailer	GHSA-wqvq-jvpq-h66f	中危	7.0.11	8.0.9	Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization 漏洞详情: https://github.com/advisories/GHSA-wqvq-jvpq-h66f 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-15 17:35 修改: 2026-06-15 17:35
@opentelemetry/core	CVE-2026-54285	中危	1.26.0	2.8.0	@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54285 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-22 18:16 修改: 2026-06-23 16:17
@opentelemetry/core	CVE-2026-54285	中危	1.30.1	2.8.0	@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54285 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-22 18:16 修改: 2026-06-23 16:17
picomatch	CVE-2026-33672	中危	4.0.3	4.0.4, 3.0.2, 2.3.2	picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33672 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-26 22:16 修改: 2026-06-17 10:37
brace-expansion	CVE-2026-33750	中危	2.0.1	5.0.5, 3.0.2, 2.0.3, 1.1.13	brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33750 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-27 15:16 修改: 2026-06-17 10:38
fast-xml-parser	CVE-2026-33349	中危	4.4.1	4.5.5, 5.5.7	fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33349 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-24 20:16 修改: 2026-06-17 10:37
fast-xml-parser	CVE-2026-41650	中危	4.4.1	5.7.0	fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41650 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-07 15:16 修改: 2026-06-17 10:46
brace-expansion	CVE-2026-33750	中危	2.0.1	5.0.5, 3.0.2, 2.0.3, 1.1.13	brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33750 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-03-27 15:16 修改: 2026-06-17 10:38
ip-address	CVE-2026-42338	中危	10.1.0	10.1.1	ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42338 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-05-12 20:16 修改: 2026-07-21 12:18
ip-address	CVE-2026-42338	中危	9.0.5	10.1.1	ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42338 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-12 20:16 修改: 2026-07-21 12:18
ip-address	CVE-2026-42338	中危	9.0.5	10.1.1	ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42338 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-05-12 20:16 修改: 2026-07-21 12:18
@opentelemetry/core	CVE-2026-54285	中危	2.2.0	2.8.0	@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54285 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-22 18:16 修改: 2026-06-23 16:17
js-yaml	CVE-2026-53550	中危	4.1.1	4.2.0, 3.15.0	js-yaml: js-yaml: Denial of Service via crafted YAML merge keys 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53550 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-22 16:16 修改: 2026-07-09 20:33
brace-expansion	CVE-2026-45149	中危	5.0.5	5.0.6	brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45149 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-05-29 20:16 修改: 2026-07-22 06:10
pnpm	CVE-2024-47829	中危	9.5.0	10.0.0	pnpm: pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting 漏洞详情: https://avd.aquasec.com/nvd/cve-2024-47829 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2025-04-23 16:15 修改: 2026-06-22 14:39
pnpm	CVE-2024-53866	中危	9.5.0	9.15.0	pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion 漏洞详情: https://avd.aquasec.com/nvd/cve-2024-53866 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2024-12-10 18:15 修改: 2026-06-22 14:38
pnpm	CVE-2026-23888	中危	9.5.0	10.28.1	pnpm: pnpm: Arbitrary file write via path traversal in binary fetcher leading to remote code execution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-23888 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-01-26 22:15 修改: 2026-06-17 10:22
pnpm	CVE-2026-23889	中危	9.5.0	10.28.1	pnpm: pnpm: Arbitrary file write via path traversal on Windows 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-23889 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-01-26 22:15 修改: 2026-06-17 10:22
pnpm	CVE-2026-23890	中危	9.5.0	10.28.1	pnpm: pnpm: Arbitrary code execution via path traversal in bin linking 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-23890 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-01-26 22:15 修改: 2026-06-17 10:22
pnpm	CVE-2026-24056	中危	9.5.0	10.28.2	pnpm: pnpm symlink traversal in file:/git dependencies 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24056 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-01-26 22:15 修改: 2026-06-17 10:22
pnpm	CVE-2026-24131	中危	9.5.0	10.28.2	pnpm: pnpm: Arbitrary file permission modification via directory traversal 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24131 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-01-26 22:15 修改: 2026-06-17 10:22
pnpm	CVE-2026-48995	中危	9.5.0	10.33.4, 11.0.7	pnpm: pnpm: Supply chain compromise from unverified dependencies 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48995 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-29 20:30
pnpm	CVE-2026-50014	中危	9.5.0	10.34.0, 11.4.0	pnpm: pnpm: Arbitrary Code Execution via Malicious Lockfile 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50014 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:14
pnpm	CVE-2026-50017	中危	9.5.0	10.34.0, 11.4.0	pnpm: pnpm: Information disclosure of authentication credentials via malicious .npmrc file 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50017 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-30 19:04
pnpm	CVE-2026-50021	中危	9.5.0	11.4.0, 10.34.1	pnpm: pnpm: Integrity bypass allows installation of altered packages via modified lockfile 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50021 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:15
pnpm	CVE-2026-50573	中危	9.5.0	10.34.0, 11.4.0	pnpm: pnpm: Package integrity check bypass allows installation of malicious content 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50573 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:15
pnpm	CVE-2026-55180	中危	9.5.0	10.34.2, 11.5.3	pnpm: pacquet: pnpm and pacquet: Information disclosure of environment secrets via improper environment variable expansion 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-55180 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:16
pnpm	CVE-2026-55699	中危	9.5.0	10.34.2, 11.5.3	pnpm: pnpm: Denial of Service due to improper handling of malicious package manifest bin keys 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-55699 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:16
postcss	CVE-2026-41305	中危	8.4.31	8.5.10	postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41305 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-24 03:16 修改: 2026-06-17 10:46
@hono/node-server	CVE-2026-39406	中危	1.19.9	1.19.13	@hono/node-server: Middleware bypass via repeated slashes in serveStatic 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39406 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-08 15:16 修改: 2026-06-17 10:42
@hono/node-server	GHSA-frvp-7c67-39w9	中危	1.19.9	2.0.5	Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) 漏洞详情: https://github.com/advisories/GHSA-frvp-7c67-39w9 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-21 18:17 修改: 2026-07-21 18:17
dompurify	CVE-2025-15599	中危	3.2.4	3.2.7	DOMPurify: DOMPurify: Cross-site scripting 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-15599 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-03 18:16 修改: 2026-06-17 08:38
lodash	CVE-2026-2950	中危	4.17.23	4.18.0	lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2950 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-31 20:16 修改: 2026-06-17 10:32
dompurify	CVE-2026-0540	中危	3.2.4	3.3.2, 2.5.9	DOMPurify: DOMPurify: Cross-site scripting vulnerability 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-0540 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-03 18:16 修改: 2026-06-17 10:10
dompurify	CVE-2026-41238	中危	3.2.4	3.4.0	DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41238 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-23 16:16 修改: 2026-06-17 10:46
protobufjs	CVE-2026-44288	中危	7.4.0	7.5.6, 8.0.2	protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44288 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
protobufjs	CVE-2026-44292	中危	7.4.0	7.5.6, 8.0.2	protobufjs: protobufjs: Data integrity impact due to prototype pollution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44292 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
protobufjs	CVE-2026-44294	中危	7.4.0	7.5.6, 8.0.2	protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44294 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
protobufjs	CVE-2026-45740	中危	7.4.0	7.5.8, 8.2.0	protobufjs: protobufjs: Denial of Service via crafted JSON descriptors 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45740 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:17 修改: 2026-06-17 10:52
protobufjs	CVE-2026-54269	中危	7.4.0	7.6.3, 8.6.0	protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54269 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-22 18:16 修改: 2026-06-24 20:40
dompurify	CVE-2026-41239	中危	3.2.4	3.4.0	DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41239 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-23 16:16 修改: 2026-06-17 10:46
dompurify	CVE-2026-41240	中危	3.2.4	3.4.0	DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41240 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-23 16:16 修改: 2026-06-17 10:46
dompurify	CVE-2026-49458	中危	3.2.4	3.4.6	dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-49458 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-14 21:17 修改: 2026-07-21 19:47
dompurify	CVE-2026-49459	中危	3.2.4	3.4.6	dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-49459 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-14 21:17 修改: 2026-07-21 19:51
dompurify	CVE-2026-49978	中危	3.2.4	3.4.7	dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-49978 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-14 21:17 修改: 2026-07-21 19:49
dompurify	GHSA-39q2-94rc-95cp	中危	3.2.4	3.4.0	DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation 漏洞详情: https://github.com/advisories/GHSA-39q2-94rc-95cp 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-16 00:46 修改: 2026-04-16 00:46
protobufjs	CVE-2026-44288	中危	7.5.4	7.5.6, 8.0.2	protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44288 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
protobufjs	CVE-2026-44292	中危	7.5.4	7.5.6, 8.0.2	protobufjs: protobufjs: Data integrity impact due to prototype pollution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44292 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
protobufjs	CVE-2026-44294	中危	7.5.4	7.5.6, 8.0.2	protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44294 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
protobufjs	CVE-2026-45740	中危	7.5.4	7.5.8, 8.2.0	protobufjs: protobufjs: Denial of Service via crafted JSON descriptors 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45740 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:17 修改: 2026-06-17 10:52
protobufjs	CVE-2026-54269	中危	7.5.4	7.6.3, 8.6.0	protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54269 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-22 18:16 修改: 2026-06-24 20:40
protobufjs	CVE-2026-59877	中危	7.5.4	7.6.5, 8.6.6	protobufjs: protobufjs: Denial of Service via crafted .proto schema 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59877 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:53
dompurify	GHSA-76mc-f452-cxcm	中危	3.2.4	3.4.7	DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` 漏洞详情: https://github.com/advisories/GHSA-76mc-f452-cxcm 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-15 19:59 修改: 2026-06-15 19:59
dompurify	GHSA-cj63-jhhr-wcxv	中危	3.2.4	3.3.2	DOMPurify USE_PROFILES prototype pollution allows event handlers 漏洞详情: https://github.com/advisories/GHSA-cj63-jhhr-wcxv 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-03 03:45 修改: 2026-05-29 21:46
serialize-javascript	CVE-2026-34043	中危	6.0.2	7.0.5	serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-34043 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-31 03:15 修改: 2026-06-17 10:38
dompurify	GHSA-cjmm-f4jc-qw8r	中危	3.2.4	3.3.2	DOMPurify ADD_ATTR predicate skips URI validation 漏洞详情: https://github.com/advisories/GHSA-cjmm-f4jc-qw8r 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-03 03:46 修改: 2026-05-29 21:47
dompurify	GHSA-cmwh-pvxp-8882	中危	3.2.4	3.4.11	DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) 漏洞详情: https://github.com/advisories/GHSA-cmwh-pvxp-8882 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-18 14:27 修改: 2026-06-18 14:27
dompurify	GHSA-h8r8-wccr-v5f2	中危	3.2.4	3.3.2	DOMPurify is vulnerable to mutation-XSS via Re-Contextualization 漏洞详情: https://github.com/advisories/GHSA-h8r8-wccr-v5f2 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-27 20:41 修改: 2026-03-27 20:41
@protobufjs/utf8	CVE-2026-44288	中危	1.1.0	1.1.1	protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44288 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
@sigstore/core	CVE-2026-48758	中危	3.2.0	3.2.1	sigstore-core: @sigstore/core: Signature bypass due to incorrect encoding in preAuthEncoding 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48758 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-07-14 21:17 修改: 2026-07-15 20:23
@sigstore/verify	CVE-2026-48816	中危	3.1.0	3.1.1	sigstore-js: github.com/sigstore/sigstore-js: sigstore-js: Insufficient verification of data authenticity allows timestamp manipulation 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48816 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-07-14 21:17 修改: 2026-07-15 20:23
ajv	CVE-2025-69873	中危	6.12.6	8.18.0, 6.14.0	ajv: ReDoS via $data reference 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-69873 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-11 19:15 修改: 2026-07-21 12:17
next	CVE-2026-27980	中危	15.5.10	16.1.7, 15.5.14	next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27980 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-18 01:16 修改: 2026-06-17 10:28
next	CVE-2026-29057	中危	15.5.10	16.1.7, 15.5.13	next.js: Next.js: HTTP request smuggling in rewrites 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-29057 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-18 01:16 修改: 2026-06-17 10:29
next	CVE-2026-44576	中危	15.5.10	15.5.16, 16.2.5	Next.js: Next.js: Cache poisoning vulnerability in React Server Components 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44576 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 17:16 修改: 2026-06-17 10:50
next	CVE-2026-44577	中危	15.5.10	15.5.16, 16.2.5	Next.js: Next.js: Denial of Service via Image Optimization API 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44577 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 17:16 修改: 2026-07-16 12:17
next	CVE-2026-44580	中危	15.5.10	15.5.16, 16.2.5	next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44580 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 18:16 修改: 2026-06-17 10:50
tar	CVE-2026-53655	中危	6.2.1	7.5.16	node-tar: node-tar: File smuggling due to inconsistent tar archive parsing 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53655 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-06-22 16:16 修改: 2026-06-26 20:03
tar	CVE-2026-59871	中危	6.2.1	7.5.18	node-tar: node-tar: Denial of Service due to incorrect PAX path handling 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59871 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-07-08 16:16 修改: 2026-07-10 19:02
tar	CVE-2026-59875	中危	6.2.1	7.5.17	node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59875 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2026-07-08 16:16 修改: 2026-07-10 19:10
next	CVE-2026-44581	中危	15.5.10	15.5.16, 16.2.5	next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44581 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 18:16 修改: 2026-06-17 10:50
next	CVE-2026-64643	中危	15.5.10	15.5.21, 16.2.11	Next.js: Unauthenticated disclosure of internal Server Function endpoints 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64643 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
tar	CVE-2026-53655	中危	7.5.13	7.5.16	node-tar: node-tar: File smuggling due to inconsistent tar archive parsing 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53655 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-06-22 16:16 修改: 2026-06-26 20:03
tar	CVE-2026-59871	中危	7.5.13	7.5.18	node-tar: node-tar: Denial of Service due to incorrect PAX path handling 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59871 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-07-08 16:16 修改: 2026-07-10 19:02
tar	CVE-2026-59875	中危	7.5.13	7.5.17	node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59875 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-07-08 16:16 修改: 2026-07-10 19:10
turbo	CVE-2026-45773	中危	2.8.16	2.9.14	Turbo: Login callback CSRF/session fixation 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45773 镜像层: sha256:0fee5d9b422cce53d7fb0ff05e3d2f211eef5395d7b71c75ba35b420ec0b66a8 发布日期: 2026-05-15 16:16 修改: 2026-06-17 10:52
next	CVE-2026-64644	中危	15.5.10	15.5.21, 16.2.11	Next.js: Denial of Service in the Image Optimization API using SVGs 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64644 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
undici	CVE-2026-9679	中危	6.25.0	6.27.0, 7.28.0, 8.5.0	undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9679 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-06-17 18:18 修改: 2026-06-25 17:43
uuid	CVE-2026-41907	中危	8.3.2	11.1.1, 12.0.1, 13.0.1	uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
uuid	CVE-2026-41907	中危	9.0.1	11.1.1, 12.0.1, 13.0.1	uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
brace-expansion	CVE-2025-5889	低危	2.0.1	2.0.2, 1.1.12, 3.0.1, 4.0.1	brace-expansion: juliangruber brace-expansion index.js expand redos 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-5889 镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68 发布日期: 2025-06-09 19:15 修改: 2026-06-17 09:48
next	CVE-2026-44572	低危	15.5.10	15.5.16, 16.2.5	next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44572 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
next	CVE-2026-44582	低危	15.5.10	15.5.16, 16.2.5	Next.js: Next.js: Cache poisoning allows incorrect response delivery 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44582 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-13 18:16 修改: 2026-06-17 10:50
fast-xml-parser	CVE-2026-27942	低危	4.4.1	5.3.8, 4.5.4	fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27942 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
dompurify	GHSA-c2j3-45gr-mqc4	低危	3.2.4	3.4.12	DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. 漏洞详情: https://github.com/advisories/GHSA-c2j3-45gr-mqc4 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-21 19:41 修改: 2026-07-21 19:41
dompurify	GHSA-gvmj-g25r-r7wr	低危	3.2.4	3.4.8	DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes 漏洞详情: https://github.com/advisories/GHSA-gvmj-g25r-r7wr 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-15 20:02 修改: 2026-06-15 20:02
dompurify	GHSA-vxr8-fq34-vvx9	低危	3.2.4	3.4.9	DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output 漏洞详情: https://github.com/advisories/GHSA-vxr8-fq34-vvx9 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-15 20:12 修改: 2026-06-15 20:12
turbo	CVE-2026-45772	低危	2.8.16	2.9.14	Turbo: Unexpected local code execution during Yarn Berry detection 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45772 镜像层: sha256:0fee5d9b422cce53d7fb0ff05e3d2f211eef5395d7b71c75ba35b420ec0b66a8 发布日期: 2026-05-15 16:16 修改: 2026-06-17 10:52
dompurify	GHSA-x4vx-rjvf-j5p4	低危	3.2.4		DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects 漏洞详情: https://github.com/advisories/GHSA-x4vx-rjvf-j5p4 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-15 20:00 修改: 2026-06-15 20:00
nodemailer	GHSA-c7w3-x93f-qmm8	低危	7.0.11	8.0.4	Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter 漏洞详情: https://github.com/advisories/GHSA-c7w3-x93f-qmm8 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-26 22:26 修改: 2026-03-26 22:26
undici	CVE-2026-11525	低危	6.25.0	6.27.0, 7.28.0, 8.5.0	undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-11525 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-06-17 18:17 修改: 2026-06-25 17:46
undici	CVE-2026-6733	低危	6.25.0	6.27.0, 7.28.0, 8.5.0	undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6733 镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f 发布日期: 2026-06-17 18:18 修改: 2026-06-27 23:46
@smithy/config-resolver	GHSA-6475-r3vj-m8vf	低危	3.0.9	4.4.0	AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value 漏洞详情: https://github.com/advisories/GHSA-6475-r3vj-m8vf 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-01-08 21:52 修改: 2026-01-08 21:52
brace-expansion	CVE-2025-5889	低危	2.0.1	2.0.2, 1.1.12, 3.0.1, 4.0.1	brace-expansion: juliangruber brace-expansion index.js expand redos 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-5889 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-06-09 19:15 修改: 2026-06-17 09:48
webpack	CVE-2025-68157	低危	5.97.1	5.104.0	webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-68157 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-05 23:15 修改: 2026-06-17 09:58
webpack	CVE-2025-68458	低危	5.97.1	5.104.1	webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-68458 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-05 23:15 修改: 2026-06-17 09:59

app/node_modules/.pnpm/@esbuild+linux-x64@0.25.7/node_modules/@esbuild/linux-x64/bin/esbuild (gobinary)

低危漏洞:2

中危漏洞:23

高危漏洞:14

严重漏洞:1

软件包	漏洞	安全状态	安装版本	修复版本	漏洞信息
stdlib	CVE-2025-68121	严重	v1.23.10	1.24.13, 1.25.7, 1.26.0-rc.3	crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-68121 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-02-05 18:16 修改: 2026-06-17 09:58
stdlib	CVE-2025-61726	高危	v1.23.10	1.24.12, 1.25.6	golang: net/url: Memory exhaustion in query parameter parsing in net/url 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61726 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-01-28 20:16 修改: 2026-07-22 12:16
stdlib	CVE-2025-61729	高危	v1.23.10	1.24.11, 1.25.5	crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61729 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-12-02 19:15 修改: 2026-06-17 09:50
stdlib	CVE-2026-25679	高危	v1.23.10	1.25.8, 1.26.1	net/url: Incorrect parsing of IPv6 host literals in net/url 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25679 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-06 22:16 修改: 2026-07-22 12:17
stdlib	CVE-2026-27145	高危	v1.23.10	1.25.11, 1.26.4	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27145 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-02 23:16 修改: 2026-07-22 19:10
stdlib	CVE-2026-32280	高危	v1.23.10	1.25.9, 1.26.2	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32280 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-08 02:16 修改: 2026-07-22 12:17
stdlib	CVE-2026-32281	高危	v1.23.10	1.25.9, 1.26.2	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32281 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-08 02:16 修改: 2026-06-17 10:35
stdlib	CVE-2026-32283	高危	v1.23.10	1.25.9, 1.26.2	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32283 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-08 02:16 修改: 2026-07-22 12:17
stdlib	CVE-2026-33811	高危	v1.23.10	1.25.10, 1.26.3	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33811 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-07 20:16 修改: 2026-07-21 12:18
stdlib	CVE-2026-33814	高危	v1.23.10	1.25.10, 1.26.3	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33814 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-07 20:16 修改: 2026-07-21 12:18
stdlib	CVE-2026-39820	高危	v1.23.10	1.25.10, 1.26.3	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39820 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-07 20:16 修改: 2026-07-22 12:17
stdlib	CVE-2026-39822	高危	v1.23.10	1.25.12, 1.26.5, 1.27.0-rc.2	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39822 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-08 17:17 修改: 2026-07-13 14:54
stdlib	CVE-2026-39836	高危	v1.23.10	1.25.10, 1.26.3	ELSA-2026-22121: golang security update (IMPORTANT) 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39836 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-07 20:16 修改: 2026-06-17 10:42
stdlib	CVE-2026-42499	高危	v1.23.10	1.25.10, 1.26.3	net/mail: golang: net/mail: Denial of Service via pathological email address parsing 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42499 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-07 20:16 修改: 2026-07-22 12:17
stdlib	CVE-2026-42504	高危	v1.23.10	1.25.11, 1.26.4	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42504 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-02 23:16 修改: 2026-07-22 19:10
stdlib	CVE-2025-47906	中危	v1.23.10	1.23.12, 1.24.6	os/exec: Unexpected paths returned from LookPath in os/exec 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-47906 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-09-18 19:15 修改: 2026-06-17 09:28
stdlib	CVE-2025-47907	中危	v1.23.10	1.23.12, 1.24.6	database/sql: Postgres Scan Race Condition 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-47907 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-08-07 16:15 修改: 2026-06-17 09:28
stdlib	CVE-2025-47912	中危	v1.23.10	1.24.8, 1.25.2	net/url: Insufficient validation of bracketed IPv6 hostnames in net/url 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-47912 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-10-29 23:16 修改: 2026-06-17 09:28
stdlib	CVE-2025-58183	中危	v1.23.10	1.24.8, 1.25.2	golang: archive/tar: Unbounded allocation when parsing GNU sparse map 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-58183 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-10-29 23:16 修改: 2026-06-17 09:44
stdlib	CVE-2025-58185	中危	v1.23.10	1.24.8, 1.25.2	encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-58185 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-10-29 23:16 修改: 2026-06-17 09:44
stdlib	CVE-2025-58187	中危	v1.23.10	1.24.9, 1.25.3	crypto/x509: Quadratic complexity when checking name constraints in crypto/x509 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-58187 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-10-29 23:16 修改: 2026-06-17 09:44
stdlib	CVE-2025-58188	中危	v1.23.10	1.24.8, 1.25.2	crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-58188 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-10-29 23:16 修改: 2026-06-17 09:44
stdlib	CVE-2025-58189	中危	v1.23.10	1.24.8, 1.25.2	crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-58189 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-10-29 23:16 修改: 2026-06-17 09:44
stdlib	CVE-2025-61723	中危	v1.23.10	1.24.8, 1.25.2	encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61723 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-10-29 23:16 修改: 2026-06-17 09:50
stdlib	CVE-2025-61724	中危	v1.23.10	1.24.8, 1.25.2	net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61724 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-10-29 23:16 修改: 2026-06-17 09:50
stdlib	CVE-2025-61725	中危	v1.23.10	1.24.8, 1.25.2	net/mail: Excessive CPU consumption in ParseAddress in net/mail 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61725 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-10-29 23:16 修改: 2026-06-17 09:50
stdlib	CVE-2025-61727	中危	v1.23.10	1.24.11, 1.25.5	golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61727 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-12-03 20:16 修改: 2026-06-17 09:50
stdlib	CVE-2025-61728	中危	v1.23.10	1.24.12, 1.25.6	golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61728 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-01-28 20:16 修改: 2026-06-17 09:50
stdlib	CVE-2025-61730	中危	v1.23.10	1.24.12, 1.25.6	crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61730 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-01-28 20:16 修改: 2026-06-17 09:50
stdlib	CVE-2026-27142	中危	v1.23.10	1.25.8, 1.26.1	html/template: URLs in meta content attribute actions are not escaped in html/template 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27142 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-06 22:16 修改: 2026-06-17 10:26
stdlib	CVE-2026-32282	中危	v1.23.10	1.25.9, 1.26.2	golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32282 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-08 02:16 修改: 2026-06-17 10:35
stdlib	CVE-2026-32288	中危	v1.23.10	1.25.9, 1.26.2	archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously-crafted archive 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32288 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-08 02:16 修改: 2026-06-17 10:35
stdlib	CVE-2026-32289	中危	v1.23.10	1.25.9, 1.26.2	html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32289 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-04-08 02:16 修改: 2026-06-17 10:35
stdlib	CVE-2026-39823	中危	v1.23.10	1.25.10, 1.26.3	html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39823 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-07 20:16 修改: 2026-06-17 10:42
stdlib	CVE-2026-39825	中危	v1.23.10	1.25.10, 1.26.3	net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39825 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-07 20:16 修改: 2026-06-17 10:42
stdlib	CVE-2026-39826	中危	v1.23.10	1.25.10, 1.26.3	html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39826 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-07 20:16 修改: 2026-06-17 10:42
stdlib	CVE-2026-42505	中危	v1.23.10	1.25.12, 1.26.5, 1.27.0-rc.2	crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42505 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-07-08 17:17 修改: 2026-07-13 17:05
stdlib	CVE-2026-42507	中危	v1.23.10	1.25.11, 1.26.4	net/textproto: golang: Golang net/textproto: Misleading error messages via input injection 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42507 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-06-02 23:16 修改: 2026-07-22 19:10
stdlib	CVE-2025-58186	低危	v1.23.10	1.24.8, 1.25.2	golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-58186 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2025-10-29 23:16 修改: 2026-06-17 09:44
stdlib	CVE-2026-27139	低危	v1.23.10	1.25.8, 1.26.1	os: FileInfo can escape from a Root in golang os module 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27139 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-03-06 22:16 修改: 2026-06-17 10:26
golang.org/x/sys	CVE-2026-39824	未知	v0.0.0-20220715151400-c0bba94af5f8	0.44.0	Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39824 镜像层: sha256:c6de4b4eb7084731a0545c7913a4424df1d7ad0113c7d041fd9075bf25b7e06a 发布日期: 2026-05-22 20:16 修改: 2026-06-17 10:42

usr/bin/migrate (gobinary)

低危漏洞:3

中危漏洞:20

高危漏洞:33

严重漏洞:4

软件包	漏洞	安全状态	安装版本	修复版本	漏洞信息
github.com/jackc/pgx/v5	CVE-2026-33815	严重	v5.5.4	5.9.0	github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33815 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-07 16:16 修改: 2026-07-21 12:18
github.com/jackc/pgx/v5	CVE-2026-33816	严重	v5.5.4	5.9.0	github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33816 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-07 16:16 修改: 2026-07-20 12:18
google.golang.org/grpc	CVE-2026-33186	严重	v1.74.2	1.79.3	google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33186 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-03-20 23:16 修改: 2026-07-21 12:18
stdlib	CVE-2025-68121	严重	v1.25.4	1.24.13, 1.25.7, 1.26.0-rc.3	crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-68121 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-02-05 18:16 修改: 2026-06-17 09:58
go.opentelemetry.io/otel	CVE-2026-29181	高危	v1.37.0	1.41.0	github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-29181 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-07 21:17 修改: 2026-07-20 12:18
go.opentelemetry.io/otel/sdk	CVE-2026-24051	高危	v1.36.0	1.40.0	OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24051 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-02-02 23:16 修改: 2026-06-17 10:22
go.opentelemetry.io/otel/sdk	CVE-2026-39883	高危	v1.36.0	1.43.0	github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39883 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-08 21:17 修改: 2026-07-15 02:20
golang.org/x/crypto	CVE-2026-39828	高危	v0.45.0	0.52.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39828 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-07-22 12:17
golang.org/x/crypto	CVE-2026-39829	高危	v0.45.0	0.52.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39829 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-07-22 12:17
golang.org/x/crypto	CVE-2026-39830	高危	v0.45.0	0.52.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39830 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-07-21 12:18
golang.org/x/crypto	CVE-2026-39831	高危	v0.45.0	0.52.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39831 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-06-17 10:42
golang.org/x/crypto	CVE-2026-39832	高危	v0.45.0	0.52.0	golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39832 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-07-22 12:17
golang.org/x/crypto	CVE-2026-39835	高危	v0.45.0	0.52.0	golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39835 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-07-22 12:17
golang.org/x/crypto	CVE-2026-42508	高危	v0.45.0	0.52.0	golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42508 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-07-22 12:17
golang.org/x/crypto	CVE-2026-46595	高危	v0.45.0	0.52.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-46595 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-07-22 12:18
golang.org/x/crypto	CVE-2026-46597	高危	v0.45.0	0.52.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-46597 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-06-17 10:53
golang.org/x/net	CVE-2026-25681	高危	v0.47.0	0.55.0	golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25681 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 16:16 修改: 2026-06-17 10:25
golang.org/x/net	CVE-2026-27136	高危	v0.47.0	0.55.0	golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27136 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 16:16 修改: 2026-06-17 10:26
golang.org/x/net	CVE-2026-33814	高危	v0.47.0	0.53.0	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33814 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-07 20:16 修改: 2026-07-21 12:18
golang.org/x/net	CVE-2026-39821	高危	v0.47.0	0.55.0	golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39821 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 16:16 修改: 2026-07-22 12:17
github.com/go-jose/go-jose/v4	CVE-2026-34986	高危	v4.0.5	4.1.4	github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-34986 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-06 17:17 修改: 2026-07-22 12:17
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	高危	v1.74.2	1.82.1	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities 漏洞详情: https://github.com/advisories/GHSA-hrxh-6v49-42gf 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-07-21 22:03 修改: 2026-07-21 22:03
github.com/jackc/pgproto3/v2	CVE-2026-32286	高危	v2.3.3		github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32286 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-03-26 20:16 修改: 2026-07-22 12:17
stdlib	CVE-2025-61726	高危	v1.25.4	1.24.12, 1.25.6	golang: net/url: Memory exhaustion in query parameter parsing in net/url 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61726 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-01-28 20:16 修改: 2026-07-22 12:16
stdlib	CVE-2025-61729	高危	v1.25.4	1.24.11, 1.25.5	crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61729 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2025-12-02 19:15 修改: 2026-06-17 09:50
stdlib	CVE-2026-25679	高危	v1.25.4	1.25.8, 1.26.1	net/url: Incorrect parsing of IPv6 host literals in net/url 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25679 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-03-06 22:16 修改: 2026-07-22 12:17
stdlib	CVE-2026-27145	高危	v1.25.4	1.25.11, 1.26.4	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27145 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-06-02 23:16 修改: 2026-07-22 19:10
stdlib	CVE-2026-32280	高危	v1.25.4	1.25.9, 1.26.2	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32280 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-08 02:16 修改: 2026-07-22 12:17
stdlib	CVE-2026-32281	高危	v1.25.4	1.25.9, 1.26.2	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32281 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-08 02:16 修改: 2026-06-17 10:35
stdlib	CVE-2026-32283	高危	v1.25.4	1.25.9, 1.26.2	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32283 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-08 02:16 修改: 2026-07-22 12:17
stdlib	CVE-2026-33811	高危	v1.25.4	1.25.10, 1.26.3	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33811 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-07 20:16 修改: 2026-07-21 12:18
stdlib	CVE-2026-33814	高危	v1.25.4	1.25.10, 1.26.3	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33814 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-07 20:16 修改: 2026-07-21 12:18
stdlib	CVE-2026-39820	高危	v1.25.4	1.25.10, 1.26.3	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39820 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-07 20:16 修改: 2026-07-22 12:17
stdlib	CVE-2026-39822	高危	v1.25.4	1.25.12, 1.26.5, 1.27.0-rc.2	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39822 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-07-08 17:17 修改: 2026-07-13 14:54
stdlib	CVE-2026-39836	高危	v1.25.4	1.25.10, 1.26.3	ELSA-2026-22121: golang security update (IMPORTANT) 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39836 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-07 20:16 修改: 2026-06-17 10:42
stdlib	CVE-2026-42499	高危	v1.25.4	1.25.10, 1.26.3	net/mail: golang: net/mail: Denial of Service via pathological email address parsing 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42499 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-07 20:16 修改: 2026-07-22 12:17
stdlib	CVE-2026-42504	高危	v1.25.4	1.25.11, 1.26.4	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42504 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-06-02 23:16 修改: 2026-07-22 19:10
go.mongodb.org/mongo-driver	CVE-2026-2303	中危	v1.7.5	1.17.7	CVE-2026-2303 affecting package telegraf for versions less than 1.29.4-21 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2303 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-02-10 20:17 修改: 2026-06-17 10:30
golang.org/x/crypto	CVE-2026-39827	中危	v0.45.0	0.52.0	golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39827 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-06-17 10:42
golang.org/x/crypto	CVE-2026-39833	中危	v0.45.0	0.52.0	golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39833 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-06-17 10:42
golang.org/x/crypto	CVE-2026-39834	中危	v0.45.0	0.52.0	golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39834 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-06-17 10:42
golang.org/x/net	CVE-2026-25680	中危	v0.47.0	0.55.0	golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25680 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 16:16 修改: 2026-06-17 10:25
golang.org/x/net	CVE-2026-42502	中危	v0.47.0	0.55.0	golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42502 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 16:16 修改: 2026-06-17 10:47
golang.org/x/net	CVE-2026-42506	中危	v0.47.0	0.55.0	golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42506 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 16:16 修改: 2026-06-17 10:47
golang.org/x/crypto	CVE-2026-46598	中危	v0.45.0	0.52.0	golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-46598 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 04:16 修改: 2026-06-17 10:53
stdlib	CVE-2025-61727	中危	v1.25.4	1.24.11, 1.25.5	golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61727 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2025-12-03 20:16 修改: 2026-06-17 09:50
stdlib	CVE-2025-61728	中危	v1.25.4	1.24.12, 1.25.6	golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61728 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-01-28 20:16 修改: 2026-06-17 09:50
stdlib	CVE-2025-61730	中危	v1.25.4	1.24.12, 1.25.6	crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-61730 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-01-28 20:16 修改: 2026-06-17 09:50
stdlib	CVE-2026-27142	中危	v1.25.4	1.25.8, 1.26.1	html/template: URLs in meta content attribute actions are not escaped in html/template 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27142 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-03-06 22:16 修改: 2026-06-17 10:26
stdlib	CVE-2026-32282	中危	v1.25.4	1.25.9, 1.26.2	golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32282 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-08 02:16 修改: 2026-06-17 10:35
stdlib	CVE-2026-32288	中危	v1.25.4	1.25.9, 1.26.2	archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously-crafted archive 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32288 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-08 02:16 修改: 2026-06-17 10:35
stdlib	CVE-2026-32289	中危	v1.25.4	1.25.9, 1.26.2	html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32289 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-04-08 02:16 修改: 2026-06-17 10:35
stdlib	CVE-2026-39823	中危	v1.25.4	1.25.10, 1.26.3	html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39823 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-07 20:16 修改: 2026-06-17 10:42
stdlib	CVE-2026-39825	中危	v1.25.4	1.25.10, 1.26.3	net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39825 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-07 20:16 修改: 2026-06-17 10:42
stdlib	CVE-2026-39826	中危	v1.25.4	1.25.10, 1.26.3	html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39826 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-07 20:16 修改: 2026-06-17 10:42
stdlib	CVE-2026-42505	中危	v1.25.4	1.25.12, 1.26.5, 1.27.0-rc.2	crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42505 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-07-08 17:17 修改: 2026-07-13 17:05
stdlib	CVE-2026-42507	中危	v1.25.4	1.25.11, 1.26.4	net/textproto: golang: Golang net/textproto: Misleading error messages via input injection 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42507 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-06-02 23:16 修改: 2026-07-22 19:10
github.com/jackc/pgx/v5	CVE-2026-41889	低危	v5.5.4	5.9.2	github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41889 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-08 17:16 修改: 2026-06-17 10:47
github.com/jackc/pgx/v4	CVE-2026-41889	低危	v4.18.2		github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41889 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-08 17:16 修改: 2026-06-17 10:47
stdlib	CVE-2026-27139	低危	v1.25.4	1.25.8, 1.26.1	os: FileInfo can escape from a Root in golang os module 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27139 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-03-06 22:16 修改: 2026-06-17 10:26
golang.org/x/sys	CVE-2026-39824	未知	v0.38.0	0.44.0	Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39824 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-05-22 20:16 修改: 2026-06-17 10:42
golang.org/x/text	CVE-2026-56852	未知	v0.31.0	0.39.0	Infinite loop on invalid input in golang.org/x/text 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-56852 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-07-21 20:17 修改: 2026-07-21 20:17
golang.org/x/crypto	GO-2026-5932	未知	v0.45.0		The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues 漏洞详情: 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
golang.org/x/net	CVE-2026-46600	未知	v0.47.0	0.56.0	Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-46600 镜像层: sha256:8b463def9b42a39182e5d6c321e478a7719a873163c3669ee3a967118c3a400b 发布日期: 2026-07-21 20:17 修改: 2026-07-21 20:17