| basic-ftp |
CVE-2026-27699 |
严重 |
5.0.5 |
5.2.0 |
basic-ftp: basic-ftp: File overwrite due to path traversal
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27699
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-25 15:20 修改: 2026-06-17 10:27
|
| fast-xml-parser |
CVE-2026-25896 |
严重 |
4.4.1 |
5.3.5, 4.5.4 |
fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25896
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-20 21:19 修改: 2026-07-21 12:17
|
| fast-xml-parser |
CVE-2026-25896 |
严重 |
4.5.0 |
5.3.5, 4.5.4 |
fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25896
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-20 21:19 修改: 2026-07-21 12:17
|
| fast-xml-parser |
CVE-2026-25896 |
严重 |
4.5.3 |
5.3.5, 4.5.4 |
fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25896
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-20 21:19 修改: 2026-07-21 12:17
|
| fast-xml-parser |
CVE-2026-25896 |
严重 |
5.2.5 |
5.3.5, 4.5.4 |
fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25896
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-20 21:19 修改: 2026-07-21 12:17
|
| protobufjs |
CVE-2026-41242 |
严重 |
7.4.0 |
8.0.1, 7.5.5 |
protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41242
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-18 17:16 修改: 2026-07-15 02:21
|
| protobufjs |
CVE-2026-41242 |
严重 |
7.5.4 |
8.0.1, 7.5.5 |
protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41242
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-18 17:16 修改: 2026-07-15 02:21
|
| shell-quote |
CVE-2026-9277 |
严重 |
1.8.3 |
1.8.4 |
shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9277
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-22 14:16 修改: 2026-07-22 12:18
|
| tar |
CVE-2026-59873 |
严重 |
6.2.1 |
7.5.19 |
tar: node-tar: Denial of Service via crafted gzip bomb
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59873
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:57
|
| tar |
CVE-2026-59873 |
严重 |
7.5.13 |
7.5.19 |
tar: node-tar: Denial of Service via crafted gzip bomb
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59873
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:57
|
| vitest |
CVE-2026-47429 |
严重 |
3.2.4 |
4.1.0, 3.2.6 |
vitest: Vitest: Arbitrary code execution and information disclosure via path traversal
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-47429
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-14 20:17 修改: 2026-07-21 16:17
|
| axios |
CVE-2026-44488 |
高危 |
1.12.2 |
1.16.0 |
axios: Axios: Denial of Service due to unenforced request and response size limits
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44488
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-11 17:16 修改: 2026-07-22 12:18
|
| axios |
CVE-2026-44494 |
高危 |
1.12.2 |
1.16.0 |
axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44494
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-11 17:16 修改: 2026-07-22 12:18
|
| axios |
CVE-2026-44495 |
高危 |
1.12.2 |
1.15.2, 0.31.1 |
axios: Axios: Information disclosure due to prototype pollution vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44495
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-11 17:16 修改: 2026-07-22 12:18
|
| axios |
CVE-2026-44496 |
高危 |
1.12.2 |
1.16.0, 0.32.0 |
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44496
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-11 17:16 修改: 2026-07-22 12:18
|
| @grpc/grpc-js |
CVE-2026-48068 |
高危 |
1.11.1 |
1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4 |
grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48068
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-14 20:17 修改: 2026-07-21 16:17
|
| basic-ftp |
CVE-2026-41324 |
高危 |
5.0.5 |
5.3.0 |
basic-ftp: basic-ftp: Denial of Service via unbounded memory growth from malicious directory listings
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41324
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 04:16 修改: 2026-06-17 10:46
|
| basic-ftp |
CVE-2026-44240 |
高危 |
5.0.5 |
5.3.1 |
basic-ftp: basic-ftp: Client-side Denial of Service via unterminated multiline FTP responses
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44240
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-12 21:16 修改: 2026-06-17 10:50
|
| basic-ftp |
GHSA-6v7q-wjvx-w8wg |
高危 |
5.0.5 |
5.2.2 |
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands
漏洞详情: https://github.com/advisories/GHSA-6v7q-wjvx-w8wg
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-10 20:18 修改: 2026-04-10 20:18
|
| brace-expansion |
CVE-2026-13149 |
高危 |
1.1.11 |
5.0.7, 1.1.16, 2.1.2 |
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
|
| brace-expansion |
CVE-2026-13149 |
高危 |
2.0.1 |
5.0.7, 1.1.16, 2.1.2 |
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
|
| brace-expansion |
CVE-2026-13149 |
高危 |
2.0.1 |
5.0.7, 1.1.16, 2.1.2 |
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
|
| brace-expansion |
CVE-2026-13149 |
高危 |
5.0.5 |
5.0.7, 1.1.16, 2.1.2 |
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
|
| cross-spawn |
CVE-2024-21538 |
高危 |
7.0.3 |
7.0.5, 6.0.6 |
cross-spawn: regular expression denial of service
漏洞详情: https://avd.aquasec.com/nvd/cve-2024-21538
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2024-11-08 05:15 修改: 2026-06-17 07:09
|
| cross-spawn |
CVE-2024-21538 |
高危 |
7.0.3 |
7.0.5, 6.0.6 |
cross-spawn: regular expression denial of service
漏洞详情: https://avd.aquasec.com/nvd/cve-2024-21538
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2024-11-08 05:15 修改: 2026-06-17 07:09
|
| dd-trace |
CVE-2026-50272 |
高危 |
5.65.0 |
5.100.0 |
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50272
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-17 21:17 修改: 2026-07-21 04:16
|
| defu |
CVE-2026-35209 |
高危 |
6.1.4 |
6.1.5 |
defu: Prototype pollution via `__proto__` key in defaults argument
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-35209
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-06 18:16 修改: 2026-07-21 19:10
|
| effect |
CVE-2026-32887 |
高危 |
3.16.12 |
3.20.0 |
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32887
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-20 22:16 修改: 2026-06-17 10:36
|
| fast-uri |
CVE-2026-13676 |
高危 |
3.0.6 |
4.0.1, 3.1.3, 2.4.2 |
fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13676
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-29 14:16 修改: 2026-07-22 12:17
|
| fast-uri |
CVE-2026-16221 |
高危 |
3.0.6 |
2.4.3, 3.1.4, 4.1.1 |
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-16221
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-19 15:16 修改: 2026-07-21 18:31
|
| fast-uri |
CVE-2026-6321 |
高危 |
3.0.6 |
3.1.1 |
fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6321
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-04 20:16 修改: 2026-07-21 12:19
|
| fast-uri |
CVE-2026-6322 |
高危 |
3.0.6 |
3.1.2 |
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6322
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-05 11:16 修改: 2026-07-22 12:18
|
| @grpc/grpc-js |
CVE-2026-48069 |
高危 |
1.11.1 |
1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4 |
grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48069
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-14 20:17 修改: 2026-07-15 20:23
|
| fast-xml-parser |
CVE-2026-26278 |
高危 |
4.4.1 |
4.5.4, 5.3.6 |
fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26278
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-19 20:25 修改: 2026-07-21 12:17
|
| fast-xml-parser |
CVE-2026-33036 |
高危 |
4.4.1 |
5.5.6, 4.5.5 |
fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33036
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-20 06:16 修改: 2026-06-17 10:36
|
| @opentelemetry/propagator-jaeger |
CVE-2026-59892 |
高危 |
1.26.0 |
2.9.0 |
@opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59892
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-08 17:17 修改: 2026-07-10 18:56
|
| fast-xml-parser |
CVE-2026-26278 |
高危 |
4.5.0 |
4.5.4, 5.3.6 |
fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26278
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-19 20:25 修改: 2026-07-21 12:17
|
| fast-xml-parser |
CVE-2026-33036 |
高危 |
4.5.0 |
5.5.6, 4.5.5 |
fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33036
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-20 06:16 修改: 2026-06-17 10:36
|
| @opentelemetry/sdk-node |
CVE-2026-44902 |
高危 |
0.53.0 |
0.217.0 |
opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44902
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-27 15:16 修改: 2026-06-17 10:51
|
| fast-xml-parser |
CVE-2026-26278 |
高危 |
4.5.3 |
4.5.4, 5.3.6 |
fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26278
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-19 20:25 修改: 2026-07-21 12:17
|
| fast-xml-parser |
CVE-2026-33036 |
高危 |
4.5.3 |
5.5.6, 4.5.5 |
fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33036
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-20 06:16 修改: 2026-06-17 10:36
|
| axios |
CVE-2026-25639 |
高危 |
1.12.2 |
1.13.5, 0.30.3 |
axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25639
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-09 21:15 修改: 2026-07-21 12:17
|
| fast-xml-parser |
CVE-2026-25128 |
高危 |
5.2.5 |
5.3.4 |
fast-xml-parser: fast-xml-parser has RangeError DoS Numeric Entities Bug
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-25128
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-01-30 16:16 修改: 2026-06-17 10:24
|
| fast-xml-parser |
CVE-2026-26278 |
高危 |
5.2.5 |
4.5.4, 5.3.6 |
fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26278
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-19 20:25 修改: 2026-07-21 12:17
|
| fast-xml-parser |
CVE-2026-33036 |
高危 |
5.2.5 |
5.5.6, 4.5.5 |
fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33036
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-20 06:16 修改: 2026-06-17 10:36
|
| flatted |
CVE-2026-32141 |
高危 |
3.3.1 |
3.4.0 |
flatted: flatted: Unbounded recursion DoS in parse() revive phase
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32141
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 18:16 修改: 2026-07-17 13:18
|
| flatted |
CVE-2026-33228 |
高危 |
3.3.1 |
3.4.2 |
flatted: Flatted: Prototype pollution vulnerability allows arbitrary code execution via crafted JSON.
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33228
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-20 23:16 修改: 2026-07-15 02:20
|
| form-data |
CVE-2026-12143 |
高危 |
2.5.5 |
2.5.6, 3.0.5, 4.0.6 |
form-data: form-data: Form field override via CRLF injection
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12143
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-12 19:16 修改: 2026-07-22 12:17
|
| form-data |
CVE-2026-12143 |
高危 |
4.0.4 |
2.5.6, 3.0.5, 4.0.6 |
form-data: form-data: Form field override via CRLF injection
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12143
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-12 19:16 修改: 2026-07-22 12:17
|
| glob |
CVE-2025-64756 |
高危 |
10.3.10 |
11.1.0, 10.5.0 |
glob: glob: Command Injection Vulnerability via Malicious Filenames
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-64756
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2025-11-17 18:15 修改: 2026-06-17 09:55
|
| js-yaml |
CVE-2026-59869 |
高危 |
4.1.1 |
3.15.0, 4.3.0 |
js-yaml: js-yaml: Denial of Service via crafted YAML documents
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59869
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-08 16:16 修改: 2026-07-13 15:05
|
| kysely |
CVE-2026-32763 |
高危 |
0.27.4 |
0.28.12 |
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-32763
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-20 00:16 修改: 2026-06-17 10:36
|
| kysely |
CVE-2026-33468 |
高危 |
0.27.4 |
0.28.14 |
Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33468
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 17:16 修改: 2026-06-17 10:37
|
| kysely |
CVE-2026-44635 |
高危 |
0.27.4 |
0.28.17 |
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44635
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-27 19:16 修改: 2026-06-17 10:51
|
| langsmith |
CVE-2026-45134 |
高危 |
0.4.12 |
0.6.0 |
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45134
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-27 20:16 修改: 2026-06-17 10:51
|
| lodash |
CVE-2026-4800 |
高危 |
4.17.21 |
4.18.0 |
lodash: lodash: Arbitrary code execution via untrusted input in template imports
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-4800
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-31 20:16 修改: 2026-07-21 12:18
|
| lodash |
CVE-2026-4800 |
高危 |
4.17.23 |
4.18.0 |
lodash: lodash: Arbitrary code execution via untrusted input in template imports
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-4800
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-31 20:16 修改: 2026-07-21 12:18
|
| lodash-es |
CVE-2026-4800 |
高危 |
4.17.22 |
4.18.0 |
lodash: lodash: Arbitrary code execution via untrusted input in template imports
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-4800
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-31 20:16 修改: 2026-07-21 12:18
|
| minimatch |
CVE-2026-26996 |
高危 |
3.1.2 |
10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 |
minimatch: minimatch: Denial of Service via specially crafted glob patterns
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26996
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-20 03:16 修改: 2026-06-17 10:26
|
| minimatch |
CVE-2026-27903 |
高危 |
3.1.2 |
10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 |
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27903
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| minimatch |
CVE-2026-27904 |
高危 |
3.1.2 |
10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 |
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27904
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| minimatch |
CVE-2026-26996 |
高危 |
5.1.6 |
10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 |
minimatch: minimatch: Denial of Service via specially crafted glob patterns
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26996
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-20 03:16 修改: 2026-06-17 10:26
|
| minimatch |
CVE-2026-27903 |
高危 |
5.1.6 |
10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 |
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27903
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| minimatch |
CVE-2026-27904 |
高危 |
5.1.6 |
10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 |
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27904
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| minimatch |
CVE-2026-26996 |
高危 |
9.0.3 |
10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 |
minimatch: minimatch: Denial of Service via specially crafted glob patterns
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26996
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-02-20 03:16 修改: 2026-06-17 10:26
|
| minimatch |
CVE-2026-27903 |
高危 |
9.0.3 |
10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 |
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27903
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| minimatch |
CVE-2026-27904 |
高危 |
9.0.3 |
10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 |
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27904
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| minimatch |
CVE-2026-26996 |
高危 |
9.0.5 |
10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 |
minimatch: minimatch: Denial of Service via specially crafted glob patterns
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26996
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-20 03:16 修改: 2026-06-17 10:26
|
| minimatch |
CVE-2026-27903 |
高危 |
9.0.5 |
10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 |
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27903
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| minimatch |
CVE-2026-27904 |
高危 |
9.0.5 |
10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 |
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27904
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| next |
CVE-2026-44573 |
高危 |
15.5.10 |
15.5.16, 16.2.5 |
next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44573
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 17:16 修改: 2026-07-16 12:17
|
| next |
CVE-2026-44574 |
高危 |
15.5.10 |
15.5.16, 16.2.5 |
Next.js: Next.js: Authorization bypass via crafted query parameters
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44574
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 17:16 修改: 2026-07-16 12:17
|
| next |
CVE-2026-44575 |
高危 |
15.5.10 |
15.5.16, 16.2.5 |
next.js: Next.js: Unauthorized access to protected content via middleware bypass
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44575
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 17:16 修改: 2026-07-16 12:17
|
| next |
CVE-2026-44578 |
高危 |
15.5.10 |
15.5.16, 16.2.5 |
Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44578
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 18:16 修改: 2026-07-16 12:17
|
| next |
CVE-2026-44579 |
高危 |
15.5.10 |
15.5.16, 16.2.5 |
next.js: Next.js: Denial of Service via crafted POST requests to server actions
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44579
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 18:16 修改: 2026-07-15 02:22
|
| next |
CVE-2026-45109 |
高危 |
15.5.10 |
15.5.18, 16.2.6 |
next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45109
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 18:16 修改: 2026-07-16 12:17
|
| next |
CVE-2026-64641 |
高危 |
15.5.10 |
15.5.21, 16.2.11 |
Next.js: Denial of Service in App Router using Server Actions
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64641
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
|
| next |
CVE-2026-64645 |
高危 |
15.5.10 |
15.5.21, 16.2.11 |
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64645
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
|
| next |
CVE-2026-64649 |
高危 |
15.5.10 |
15.5.21, 16.2.11 |
Next.js: Server-Side Request Forgery in Server Actions on custom servers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64649
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
|
| next |
GHSA-8h8q-6873-q5fj |
高危 |
15.5.10 |
15.5.16, 16.2.5 |
Next.js Vulnerable to Denial of Service with Server Components
漏洞详情: https://github.com/advisories/GHSA-8h8q-6873-q5fj
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-11 14:50 修改: 2026-05-11 14:50
|
| next |
GHSA-q4gf-8mx6-v5v3 |
高危 |
15.5.10 |
15.5.15, 16.2.3 |
Next.js has a Denial of Service with Server Components
漏洞详情: https://github.com/advisories/GHSA-q4gf-8mx6-v5v3
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-10 15:35 修改: 2026-04-10 15:35
|
| nodemailer |
GHSA-p6gq-j5cr-w38f |
高危 |
7.0.11 |
9.0.1 |
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
漏洞详情: https://github.com/advisories/GHSA-p6gq-j5cr-w38f
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-18 14:28 修改: 2026-06-18 14:28
|
| path-to-regexp |
CVE-2026-4867 |
高危 |
0.1.12 |
0.1.13 |
path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-4867
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 17:16 修改: 2026-06-17 10:57
|
| path-to-regexp |
CVE-2026-4926 |
高危 |
8.3.0 |
8.4.0 |
path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-4926
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 19:17 修改: 2026-07-21 12:18
|
| picomatch |
CVE-2026-33671 |
高危 |
2.3.1 |
4.0.4, 3.0.2, 2.3.2 |
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33671
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 22:16 修改: 2026-06-17 10:37
|
| picomatch |
CVE-2026-33671 |
高危 |
4.0.3 |
4.0.4, 3.0.2, 2.3.2 |
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33671
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 22:16 修改: 2026-06-17 10:37
|
| pnpm |
CVE-2025-69262 |
高危 |
9.5.0 |
10.27.0 |
pnpm: pnpm: Remote code execution via command injection in tokenHelper environment variable substitution
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-69262
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-01-07 23:15 修改: 2026-06-22 14:39
|
| pnpm |
CVE-2025-69263 |
高危 |
9.5.0 |
10.26.0 |
pnpm: pnpm Lockfile Integrity Bypass
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-69263
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-01-07 22:15 修改: 2026-07-15 02:17
|
| pnpm |
CVE-2026-50015 |
高危 |
9.5.0 |
10.34.0, 11.4.0 |
pnpm: pnpm: Arbitrary file write/delete due to lack of path validation in patch files
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50015
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:15
|
| pnpm |
CVE-2026-50016 |
高危 |
9.5.0 |
10.34.0, 11.4.0 |
pnpm: pnpm: Arbitrary code execution due to path traversal in dependency aliases
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50016
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-29 23:57
|
| pnpm |
CVE-2026-55487 |
高危 |
9.5.0 |
10.34.2, 11.5.3 |
pnpm: pnpm: Supply chain compromise via manipulated package source strings
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-55487
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:16
|
| pnpm |
CVE-2026-55697 |
高危 |
9.5.0 |
11.5.3 |
pnpm: pnpm: Arbitrary code execution via improper handling of config dependencies
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-55697
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-30 19:04
|
| pnpm |
CVE-2026-55698 |
高危 |
9.5.0 |
10.34.2, 11.5.3 |
pnpm: pnpm: Arbitrary code execution via malicious package-manager lockfile
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-55698
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-30 19:03
|
| pnpm |
GHSA-72r4-9c5j-mj57 |
高危 |
9.5.0 |
10.34.4, 11.7.0 |
pnpm: `patch-remove` could delete project-selected files outside the patches directory
漏洞详情: https://github.com/advisories/GHSA-72r4-9c5j-mj57
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-27 00:12 修改: 2026-06-27 00:12
|
| pnpm |
GHSA-fr4h-3cph-29xv |
高危 |
9.5.0 |
10.34.4, 11.7.0 |
pnpm: Hoisted install imports lockfile alias outside node_modules
漏洞详情: https://github.com/advisories/GHSA-fr4h-3cph-29xv
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-27 00:02 修改: 2026-06-27 00:03
|
| pnpm |
GHSA-qrv3-253h-g69c |
高危 |
9.5.0 |
10.34.4, 11.8.0 |
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
漏洞详情: https://github.com/advisories/GHSA-qrv3-253h-g69c
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-27 00:13 修改: 2026-06-27 00:13
|
| axios |
CVE-2026-42033 |
高危 |
1.12.2 |
1.15.1, 0.31.1 |
axios: Axios: HTTP Transport Hijacking via Prototype Pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42033
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-07-21 12:18
|
| protobufjs |
CVE-2026-44289 |
高危 |
7.4.0 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44289
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-07-22 12:18
|
| protobufjs |
CVE-2026-44290 |
高危 |
7.4.0 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Denial of Service via crafted schema
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44290
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| protobufjs |
CVE-2026-44291 |
高危 |
7.4.0 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44291
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| protobufjs |
CVE-2026-44293 |
高危 |
7.4.0 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44293
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-07-22 12:18
|
| protobufjs |
CVE-2026-48712 |
高危 |
7.4.0 |
7.6.1, 8.4.1 |
protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48712
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 18:16 修改: 2026-06-26 20:04
|
| axios |
CVE-2026-42035 |
高危 |
1.12.2 |
1.15.1, 0.31.1 |
axios: Axios: Arbitrary HTTP header injection via prototype pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42035
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-06-17 10:47
|
| protobufjs |
CVE-2026-44289 |
高危 |
7.5.4 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44289
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-07-22 12:18
|
| protobufjs |
CVE-2026-44290 |
高危 |
7.5.4 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Denial of Service via crafted schema
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44290
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| protobufjs |
CVE-2026-44291 |
高危 |
7.5.4 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44291
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| protobufjs |
CVE-2026-44293 |
高危 |
7.5.4 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44293
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-07-22 12:18
|
| protobufjs |
CVE-2026-48712 |
高危 |
7.5.4 |
7.6.1, 8.4.1 |
protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48712
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 18:16 修改: 2026-06-26 20:04
|
| rollup |
CVE-2026-27606 |
高危 |
4.53.3 |
2.80.0, 3.30.0, 4.59.0 |
rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27606
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-25 03:16 修改: 2026-07-20 12:18
|
| sharp |
GHSA-f88m-g3jw-g9cj |
高危 |
0.34.5 |
0.35.0 |
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
漏洞详情: https://github.com/advisories/GHSA-f88m-g3jw-g9cj
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-21 22:07 修改: 2026-07-21 22:07
|
| axios |
CVE-2026-42043 |
高危 |
1.12.2 |
1.15.1, 0.31.1 |
axios: Axios: NO_PROXY bypass via crafted URL
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42043
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-07-21 12:18
|
| shell-quote |
CVE-2026-13311 |
高危 |
1.8.3 |
1.9.0 |
shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13311
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-25 05:16 修改: 2026-06-26 19:03
|
| sigstore |
CVE-2026-48815 |
高危 |
4.1.0 |
4.1.1 |
sigstore: Sigstore: Unauthorized certificates accepted due to ignored `certificateOIDs` verification option
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48815
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-07-14 21:17 修改: 2026-07-15 20:23
|
| axios |
CVE-2026-42264 |
高危 |
1.12.2 |
1.15.2 |
axios: Axios: Prototype pollution allows information disclosure and request manipulation
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42264
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-08 04:16 修改: 2026-07-21 12:18
|
| tar |
CVE-2026-23745 |
高危 |
6.2.1 |
7.5.3 |
node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-23745
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-01-16 22:16 修改: 2026-07-21 12:17
|
| tar |
CVE-2026-23950 |
高危 |
6.2.1 |
7.5.4 |
node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-23950
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-01-20 01:15 修改: 2026-07-15 02:18
|
| tar |
CVE-2026-24842 |
高危 |
6.2.1 |
7.5.7 |
node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24842
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-01-28 01:16 修改: 2026-07-15 02:18
|
| tar |
CVE-2026-26960 |
高危 |
6.2.1 |
7.5.8 |
node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-26960
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-02-20 02:16 修改: 2026-06-17 10:26
|
| tar |
CVE-2026-29786 |
高危 |
6.2.1 |
7.5.10 |
node-tar: hardlink path traversal via drive-relative linkpath
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-29786
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-03-07 16:15 修改: 2026-07-15 02:19
|
| tar |
CVE-2026-31802 |
高危 |
6.2.1 |
7.5.11 |
tar: tar: File overwrite via drive-relative symlink traversal
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-31802
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-03-10 07:44 修改: 2026-06-17 10:34
|
| tar |
CVE-2026-59874 |
高危 |
6.2.1 |
7.5.18 |
tar: Node-tar: Denial of Service via malformed tar archive header
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59874
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:54
|
| axios |
CVE-2026-44486 |
高危 |
1.12.2 |
1.16.0, 0.32.0 |
axios: Axios: Information disclosure of proxy credentials via HTTP redirects
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44486
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-11 17:16 修改: 2026-07-22 12:18
|
| tar |
CVE-2026-59874 |
高危 |
7.5.13 |
7.5.18 |
tar: Node-tar: Denial of Service via malformed tar archive header
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59874
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:54
|
| tmp |
CVE-2026-44705 |
高危 |
0.2.1 |
0.2.6 |
tmp is a temporary file and directory creator for node.js. Prior to 0. ...
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44705
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-11 17:16 修改: 2026-06-17 10:51
|
| undici |
CVE-2026-12151 |
高危 |
6.21.3 |
6.27.0, 7.28.0, 8.5.0 |
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12151
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-17 17:16 修改: 2026-07-21 12:17
|
| undici |
CVE-2026-1526 |
高危 |
6.21.3 |
6.24.0, 7.24.0 |
undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-1526
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 21:16 修改: 2026-07-15 02:18
|
| undici |
CVE-2026-1528 |
高危 |
6.21.3 |
6.24.0, 7.24.0 |
undici: undici: Denial of Service via crafted WebSocket frame with large length
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-1528
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 21:16 修改: 2026-07-15 02:18
|
| undici |
CVE-2026-2229 |
高危 |
6.21.3 |
6.24.0, 7.24.0 |
undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2229
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 21:16 修改: 2026-07-15 02:19
|
| undici |
CVE-2026-12151 |
高危 |
6.25.0 |
6.27.0, 7.28.0, 8.5.0 |
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12151
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-06-17 17:16 修改: 2026-07-21 12:17
|
| undici |
CVE-2026-12151 |
高危 |
7.18.2 |
6.27.0, 7.28.0, 8.5.0 |
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12151
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-17 17:16 修改: 2026-07-21 12:17
|
| undici |
CVE-2026-1526 |
高危 |
7.18.2 |
6.24.0, 7.24.0 |
undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-1526
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 21:16 修改: 2026-07-15 02:18
|
| undici |
CVE-2026-1528 |
高危 |
7.18.2 |
6.24.0, 7.24.0 |
undici: undici: Denial of Service via crafted WebSocket frame with large length
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-1528
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 21:16 修改: 2026-07-15 02:18
|
| undici |
CVE-2026-2229 |
高危 |
7.18.2 |
6.24.0, 7.24.0 |
undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2229
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 21:16 修改: 2026-07-15 02:19
|
| vite |
CVE-2026-39363 |
高危 |
7.0.5 |
8.0.5, 7.3.2, 6.4.2 |
Vite: Vite: Information disclosure via WebSocket connection bypasses access control
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39363
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-07 20:16 修改: 2026-07-15 02:20
|
| vite |
CVE-2026-53571 |
高危 |
7.0.5 |
8.0.16, 7.3.5, 6.4.3 |
vite: `server.fs.deny` bypass on Windows alternate paths
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53571
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 18:16 修改: 2026-06-24 20:44
|
| axios |
CVE-2026-44487 |
高危 |
1.12.2 |
1.16.0, 0.32.0 |
axios: Axios: Information disclosure of proxy credentials via redirect flows
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44487
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-11 17:16 修改: 2026-07-22 12:18
|
| ws |
CVE-2026-48779 |
高危 |
8.18.3 |
5.2.5, 6.2.4, 7.5.11, 8.21.0 |
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48779
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-17 13:20 修改: 2026-07-21 12:18
|
| next |
CVE-2026-64646 |
中危 |
15.5.10 |
15.5.21, 16.2.11 |
Next.js: Unbounded Server Action payload in Edge runtime
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64646
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
|
| next |
CVE-2026-64647 |
中危 |
15.5.10 |
15.5.21, 16.2.11 |
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64647
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
|
| next |
CVE-2026-64648 |
中危 |
15.5.10 |
15.5.21, 16.2.11 |
Next.js: Cache confusion of response bodies for requests with bodies
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64648
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
|
| @opentelemetry/core |
CVE-2026-54285 |
中危 |
2.2.0 |
2.8.0 |
@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54285
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 18:16 修改: 2026-06-23 16:17
|
| nodemailer |
GHSA-268h-hp4c-crq3 |
中危 |
7.0.11 |
8.0.9 |
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
漏洞详情: https://github.com/advisories/GHSA-268h-hp4c-crq3
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-15 17:36 修改: 2026-06-15 17:36
|
| nodemailer |
GHSA-r7g4-qg5f-qqm2 |
中危 |
7.0.11 |
8.0.8 |
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
漏洞详情: https://github.com/advisories/GHSA-r7g4-qg5f-qqm2
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-15 17:34 修改: 2026-06-15 17:34
|
| nodemailer |
GHSA-vvjj-xcjg-gr5g |
中危 |
7.0.11 |
8.0.5 |
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
漏洞详情: https://github.com/advisories/GHSA-vvjj-xcjg-gr5g
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-08 15:05 修改: 2026-04-08 15:05
|
| nodemailer |
GHSA-wqvq-jvpq-h66f |
中危 |
7.0.11 |
8.0.9 |
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
漏洞详情: https://github.com/advisories/GHSA-wqvq-jvpq-h66f
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-15 17:35 修改: 2026-06-15 17:35
|
| @opentelemetry/core |
CVE-2026-54285 |
中危 |
1.26.0 |
2.8.0 |
@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54285
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 18:16 修改: 2026-06-23 16:17
|
| follow-redirects |
GHSA-r4q5-vmmm-2653 |
中危 |
1.15.11 |
1.16.0 |
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
漏洞详情: https://github.com/advisories/GHSA-r4q5-vmmm-2653
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-14 01:11 修改: 2026-04-14 01:11
|
| path-to-regexp |
CVE-2026-4923 |
中危 |
8.3.0 |
8.4.0 |
path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-4923
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 19:17 修改: 2026-06-17 10:57
|
| brace-expansion |
CVE-2026-33750 |
中危 |
2.0.1 |
5.0.5, 3.0.2, 2.0.3, 1.1.13 |
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33750
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-27 15:16 修改: 2026-06-17 10:38
|
| picomatch |
CVE-2026-33672 |
中危 |
2.3.1 |
4.0.4, 3.0.2, 2.3.2 |
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33672
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 22:16 修改: 2026-06-17 10:37
|
| brace-expansion |
CVE-2026-33750 |
中危 |
2.0.1 |
5.0.5, 3.0.2, 2.0.3, 1.1.13 |
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33750
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-03-27 15:16 修改: 2026-06-17 10:38
|
| picomatch |
CVE-2026-33672 |
中危 |
4.0.3 |
4.0.4, 3.0.2, 2.3.2 |
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33672
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 22:16 修改: 2026-06-17 10:37
|
| @opentelemetry/core |
CVE-2026-54285 |
中危 |
1.30.1 |
2.8.0 |
@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54285
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 18:16 修改: 2026-06-23 16:17
|
| ip-address |
CVE-2026-42338 |
中危 |
10.1.0 |
10.1.1 |
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42338
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-12 20:16 修改: 2026-07-21 12:18
|
| ip-address |
CVE-2026-42338 |
中危 |
10.1.0 |
10.1.1 |
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42338
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-05-12 20:16 修改: 2026-07-21 12:18
|
| ip-address |
CVE-2026-42338 |
中危 |
9.0.5 |
10.1.1 |
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42338
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-05-12 20:16 修改: 2026-07-21 12:18
|
| brace-expansion |
CVE-2026-45149 |
中危 |
5.0.5 |
5.0.6 |
brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45149
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-05-29 20:16 修改: 2026-07-22 06:10
|
| js-yaml |
CVE-2026-53550 |
中危 |
4.1.1 |
4.2.0, 3.15.0 |
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53550
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 16:16 修改: 2026-07-09 20:33
|
| axios |
CVE-2025-62718 |
中危 |
1.12.2 |
1.15.0, 0.31.0 |
axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-62718
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-09 15:16 修改: 2026-07-21 12:17
|
| axios |
CVE-2026-40175 |
中危 |
1.12.2 |
1.15.0, 0.31.0 |
axios: Axios: Remote Code Execution via Prototype Pollution escalation
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-40175
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-10 20:16 修改: 2026-07-21 12:18
|
| axios |
CVE-2026-42034 |
中危 |
1.12.2 |
1.15.1, 0.31.1 |
axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42034
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-06-17 10:47
|
| axios |
CVE-2026-42036 |
中危 |
1.12.2 |
1.15.1, 0.31.1 |
axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42036
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-06-17 10:47
|
| pnpm |
CVE-2024-47829 |
中危 |
9.5.0 |
10.0.0 |
pnpm: pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
漏洞详情: https://avd.aquasec.com/nvd/cve-2024-47829
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2025-04-23 16:15 修改: 2026-06-22 14:39
|
| pnpm |
CVE-2024-53866 |
中危 |
9.5.0 |
9.15.0 |
pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion
漏洞详情: https://avd.aquasec.com/nvd/cve-2024-53866
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2024-12-10 18:15 修改: 2026-06-22 14:38
|
| pnpm |
CVE-2026-23888 |
中危 |
9.5.0 |
10.28.1 |
pnpm: pnpm: Arbitrary file write via path traversal in binary fetcher leading to remote code execution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-23888
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-01-26 22:15 修改: 2026-06-17 10:22
|
| pnpm |
CVE-2026-23889 |
中危 |
9.5.0 |
10.28.1 |
pnpm: pnpm: Arbitrary file write via path traversal on Windows
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-23889
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-01-26 22:15 修改: 2026-06-17 10:22
|
| pnpm |
CVE-2026-23890 |
中危 |
9.5.0 |
10.28.1 |
pnpm: pnpm: Arbitrary code execution via path traversal in bin linking
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-23890
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-01-26 22:15 修改: 2026-06-17 10:22
|
| pnpm |
CVE-2026-24056 |
中危 |
9.5.0 |
10.28.2 |
pnpm: pnpm symlink traversal in file:/git dependencies
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24056
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-01-26 22:15 修改: 2026-06-17 10:22
|
| pnpm |
CVE-2026-24131 |
中危 |
9.5.0 |
10.28.2 |
pnpm: pnpm: Arbitrary file permission modification via directory traversal
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24131
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-01-26 22:15 修改: 2026-06-17 10:22
|
| pnpm |
CVE-2026-48995 |
中危 |
9.5.0 |
10.33.4, 11.0.7 |
pnpm: pnpm: Supply chain compromise from unverified dependencies
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48995
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-29 20:30
|
| pnpm |
CVE-2026-50014 |
中危 |
9.5.0 |
10.34.0, 11.4.0 |
pnpm: pnpm: Arbitrary Code Execution via Malicious Lockfile
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50014
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:14
|
| pnpm |
CVE-2026-50017 |
中危 |
9.5.0 |
10.34.0, 11.4.0 |
pnpm: pnpm: Information disclosure of authentication credentials via malicious .npmrc file
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50017
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-30 19:04
|
| pnpm |
CVE-2026-50021 |
中危 |
9.5.0 |
11.4.0, 10.34.1 |
pnpm: pnpm: Integrity bypass allows installation of altered packages via modified lockfile
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50021
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:15
|
| pnpm |
CVE-2026-50573 |
中危 |
9.5.0 |
10.34.0, 11.4.0 |
pnpm: pnpm: Package integrity check bypass allows installation of malicious content
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50573
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:15
|
| pnpm |
CVE-2026-55180 |
中危 |
9.5.0 |
10.34.2, 11.5.3 |
pnpm: pacquet: pnpm and pacquet: Information disclosure of environment secrets via improper environment variable expansion
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-55180
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:16
|
| pnpm |
CVE-2026-55699 |
中危 |
9.5.0 |
10.34.2, 11.5.3 |
pnpm: pnpm: Denial of Service due to improper handling of malicious package manifest bin keys
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-55699
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-25 18:16 修改: 2026-06-29 21:16
|
| postcss |
CVE-2026-41305 |
中危 |
8.4.31 |
8.5.10 |
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41305
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 03:16 修改: 2026-06-17 10:46
|
| postcss |
CVE-2026-41305 |
中危 |
8.5.6 |
8.5.10 |
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41305
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 03:16 修改: 2026-06-17 10:46
|
| langsmith |
CVE-2026-40190 |
中危 |
0.4.12 |
0.5.18 |
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-40190
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-10 20:16 修改: 2026-07-07 18:33
|
| langsmith |
CVE-2026-41182 |
中危 |
0.4.12 |
0.5.19 |
LangSmith SDK: Streaming token events bypass output redaction
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41182
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-23 02:16 修改: 2026-06-17 10:46
|
| axios |
CVE-2026-42037 |
中危 |
1.12.2 |
1.15.1 |
axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42037
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-06-17 10:47
|
| lodash |
CVE-2025-13465 |
中危 |
4.17.21 |
4.17.23 |
lodash: prototype pollution in _.unset and _.omit functions
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-13465
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-01-21 20:16 修改: 2026-07-21 12:16
|
| lodash |
CVE-2026-2950 |
中危 |
4.17.21 |
4.18.0 |
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2950
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-31 20:16 修改: 2026-06-17 10:32
|
| axios |
CVE-2026-42038 |
中危 |
1.12.2 |
1.15.1, 0.31.1 |
axios: Axios: Information disclosure due to `no_proxy` bypass
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42038
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-06-17 10:47
|
| protobufjs |
CVE-2026-44288 |
中危 |
7.4.0 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44288
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| protobufjs |
CVE-2026-44292 |
中危 |
7.4.0 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Data integrity impact due to prototype pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44292
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| protobufjs |
CVE-2026-44294 |
中危 |
7.4.0 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44294
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| protobufjs |
CVE-2026-45740 |
中危 |
7.4.0 |
7.5.8, 8.2.0 |
protobufjs: protobufjs: Denial of Service via crafted JSON descriptors
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45740
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:17 修改: 2026-06-17 10:52
|
| protobufjs |
CVE-2026-54269 |
中危 |
7.4.0 |
7.6.3, 8.6.0 |
protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54269
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 18:16 修改: 2026-06-24 20:40
|
| lodash |
CVE-2026-2950 |
中危 |
4.17.23 |
4.18.0 |
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2950
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-31 20:16 修改: 2026-06-17 10:32
|
| axios |
CVE-2026-42039 |
中危 |
1.12.2 |
1.15.1, 0.31.1 |
axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42039
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-07-21 12:18
|
| lodash-es |
CVE-2025-13465 |
中危 |
4.17.22 |
4.17.23 |
lodash: prototype pollution in _.unset and _.omit functions
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-13465
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-01-21 20:16 修改: 2026-07-21 12:16
|
| lodash-es |
CVE-2026-2950 |
中危 |
4.17.22 |
4.18.0 |
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2950
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-31 20:16 修改: 2026-06-17 10:32
|
| axios |
CVE-2026-42041 |
中危 |
1.12.2 |
1.15.1, 0.31.1 |
axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42041
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-07-21 12:18
|
| axios |
CVE-2026-42042 |
中危 |
1.12.2 |
1.15.1, 0.31.1 |
axios: Axios: XSRF token bypass leading to information disclosure
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42042
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-06-17 10:47
|
| protobufjs |
CVE-2026-44288 |
中危 |
7.5.4 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44288
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| protobufjs |
CVE-2026-44292 |
中危 |
7.5.4 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Data integrity impact due to prototype pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44292
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| protobufjs |
CVE-2026-44294 |
中危 |
7.5.4 |
7.5.6, 8.0.2 |
protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44294
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| protobufjs |
CVE-2026-45740 |
中危 |
7.5.4 |
7.5.8, 8.2.0 |
protobufjs: protobufjs: Denial of Service via crafted JSON descriptors
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45740
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:17 修改: 2026-06-17 10:52
|
| protobufjs |
CVE-2026-54269 |
中危 |
7.5.4 |
7.6.3, 8.6.0 |
protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54269
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 18:16 修改: 2026-06-24 20:40
|
| protobufjs |
CVE-2026-59877 |
中危 |
7.5.4 |
7.6.5, 8.6.6 |
protobufjs: protobufjs: Denial of Service via crafted .proto schema
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59877
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-08 16:16 修改: 2026-07-10 18:53
|
| qs |
CVE-2026-8723 |
中危 |
6.14.1 |
6.15.2 |
### Summary `qs.stringify` throws `TypeError` when called with `arr ...
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8723
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-17 00:16 修改: 2026-06-17 11:04
|
| axios |
CVE-2026-42044 |
中危 |
1.12.2 |
1.15.2 |
axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42044
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-07-21 12:18
|
| axios |
CVE-2026-44490 |
中危 |
1.12.2 |
1.16.0, 0.32.0 |
axios: Axios: Information disclosure and denial of service due to prototype pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44490
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-11 17:16 修改: 2026-06-17 10:50
|
| axios |
GHSA-42h9-826w-cgv3 |
中危 |
1.12.2 |
0.33.0, 1.18.0 |
Axios: Excessive recursion in formDataToJSON can cause denial of service
漏洞详情: https://github.com/advisories/GHSA-42h9-826w-cgv3
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-20 17:58 修改: 2026-07-20 17:58
|
| fast-xml-parser |
CVE-2026-33349 |
中危 |
4.4.1 |
4.5.5, 5.5.7 |
fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33349
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-24 20:16 修改: 2026-06-17 10:37
|
| fast-xml-parser |
CVE-2026-41650 |
中危 |
4.4.1 |
5.7.0 |
fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41650
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-07 15:16 修改: 2026-06-17 10:46
|
| axios |
GHSA-7q8q-rj6j-mhjq |
中危 |
1.12.2 |
0.33.0, 1.18.0 |
Axios: Nested axios option objects can consume polluted prototype values
漏洞详情: https://github.com/advisories/GHSA-7q8q-rj6j-mhjq
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-20 22:37 修改: 2026-07-20 22:37
|
| axios |
GHSA-jqh4-m9w3-8hp9 |
中危 |
1.12.2 |
1.18.0 |
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
漏洞详情: https://github.com/advisories/GHSA-jqh4-m9w3-8hp9
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-20 22:27 修改: 2026-07-20 22:27
|
| axios |
GHSA-mmx7-hfxf-jppx |
中危 |
1.12.2 |
1.18.0, 0.33.0 |
Axios: Prototype pollution gadgets can alter axios request construction
漏洞详情: https://github.com/advisories/GHSA-mmx7-hfxf-jppx
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-20 22:25 修改: 2026-07-20 22:25
|
| fast-xml-parser |
CVE-2026-33349 |
中危 |
4.5.0 |
4.5.5, 5.5.7 |
fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33349
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-24 20:16 修改: 2026-06-17 10:37
|
| fast-xml-parser |
CVE-2026-41650 |
中危 |
4.5.0 |
5.7.0 |
fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41650
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-07 15:16 修改: 2026-06-17 10:46
|
| axios |
GHSA-pmv8-rq9r-6j72 |
中危 |
1.12.2 |
0.33.0, 1.18.0 |
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
漏洞详情: https://github.com/advisories/GHSA-pmv8-rq9r-6j72
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-20 17:48 修改: 2026-07-20 17:48
|
| @protobufjs/utf8 |
CVE-2026-44288 |
中危 |
1.1.0 |
1.1.1 |
protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44288
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| @sigstore/core |
CVE-2026-48758 |
中危 |
3.2.0 |
3.2.1 |
sigstore-core: @sigstore/core: Signature bypass due to incorrect encoding in preAuthEncoding
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48758
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-07-14 21:17 修改: 2026-07-15 20:23
|
| tar |
CVE-2026-53655 |
中危 |
6.2.1 |
7.5.16 |
node-tar: node-tar: File smuggling due to inconsistent tar archive parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53655
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-06-22 16:16 修改: 2026-06-26 20:03
|
| tar |
CVE-2026-59871 |
中危 |
6.2.1 |
7.5.18 |
node-tar: node-tar: Denial of Service due to incorrect PAX path handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59871
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-07-08 16:16 修改: 2026-07-10 19:02
|
| tar |
CVE-2026-59875 |
中危 |
6.2.1 |
7.5.17 |
node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59875
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2026-07-08 16:16 修改: 2026-07-10 19:10
|
| fast-xml-parser |
CVE-2026-33349 |
中危 |
4.5.3 |
4.5.5, 5.5.7 |
fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33349
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-24 20:16 修改: 2026-06-17 10:37
|
| fast-xml-parser |
CVE-2026-41650 |
中危 |
4.5.3 |
5.7.0 |
fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41650
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-07 15:16 修改: 2026-06-17 10:46
|
| tar |
CVE-2026-53655 |
中危 |
7.5.13 |
7.5.16 |
node-tar: node-tar: File smuggling due to inconsistent tar archive parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53655
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-06-22 16:16 修改: 2026-06-26 20:03
|
| tar |
CVE-2026-59871 |
中危 |
7.5.13 |
7.5.18 |
node-tar: node-tar: Denial of Service due to incorrect PAX path handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59871
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-07-08 16:16 修改: 2026-07-10 19:02
|
| tar |
CVE-2026-59875 |
中危 |
7.5.13 |
7.5.17 |
node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59875
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-07-08 16:16 修改: 2026-07-10 19:10
|
| @sigstore/verify |
CVE-2026-48816 |
中危 |
3.1.0 |
3.1.1 |
sigstore-js: github.com/sigstore/sigstore-js: sigstore-js: Insufficient verification of data authenticity allows timestamp manipulation
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48816
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-07-14 21:17 修改: 2026-07-15 20:23
|
| turbo |
CVE-2026-45773 |
中危 |
2.8.16 |
2.9.14 |
Turbo: Login callback CSRF/session fixation
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45773
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-15 16:16 修改: 2026-06-17 10:52
|
| turbo |
CVE-2026-45773 |
中危 |
2.8.16 |
2.9.14 |
Turbo: Login callback CSRF/session fixation
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45773
镜像层: sha256:0fee5d9b422cce53d7fb0ff05e3d2f211eef5395d7b71c75ba35b420ec0b66a8
发布日期: 2026-05-15 16:16 修改: 2026-06-17 10:52
|
| ajv |
CVE-2025-69873 |
中危 |
6.12.6 |
8.18.0, 6.14.0 |
ajv: ReDoS via $data reference
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-69873
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-11 19:15 修改: 2026-07-21 12:17
|
| ajv |
CVE-2025-69873 |
中危 |
8.17.1 |
8.18.0, 6.14.0 |
ajv: ReDoS via $data reference
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-69873
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-11 19:15 修改: 2026-07-21 12:17
|
| brace-expansion |
CVE-2026-33750 |
中危 |
1.1.11 |
5.0.5, 3.0.2, 2.0.3, 1.1.13 |
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33750
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-27 15:16 修改: 2026-06-17 10:38
|
| fast-xml-parser |
CVE-2026-33349 |
中危 |
5.2.5 |
4.5.5, 5.5.7 |
fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33349
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-24 20:16 修改: 2026-06-17 10:37
|
| undici |
CVE-2026-1525 |
中危 |
6.21.3 |
6.24.0, 7.24.0 |
undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-1525
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 20:16 修改: 2026-06-17 10:15
|
| undici |
CVE-2026-1527 |
中危 |
6.21.3 |
6.24.0, 7.24.0 |
undici: Undici: HTTP header injection and request smuggling vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-1527
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 21:16 修改: 2026-06-17 10:16
|
| undici |
CVE-2026-22036 |
中危 |
6.21.3 |
7.18.2, 6.23.0 |
undici: Undici: Denial of Service via excessive decompression steps
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-22036
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-01-14 19:16 修改: 2026-06-17 10:19
|
| undici |
CVE-2026-9679 |
中危 |
6.21.3 |
6.27.0, 7.28.0, 8.5.0 |
undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9679
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-17 18:18 修改: 2026-06-25 17:43
|
| fast-xml-parser |
CVE-2026-41650 |
中危 |
5.2.5 |
5.7.0 |
fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41650
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-07 15:16 修改: 2026-06-17 10:46
|
| undici |
CVE-2026-9679 |
中危 |
6.25.0 |
6.27.0, 7.28.0, 8.5.0 |
undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9679
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-06-17 18:18 修改: 2026-06-25 17:43
|
| next |
CVE-2026-27980 |
中危 |
15.5.10 |
16.1.7, 15.5.14 |
next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27980
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-18 01:16 修改: 2026-06-17 10:28
|
| next |
CVE-2026-29057 |
中危 |
15.5.10 |
16.1.7, 15.5.13 |
next.js: Next.js: HTTP request smuggling in rewrites
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-29057
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-18 01:16 修改: 2026-06-17 10:29
|
| next |
CVE-2026-44576 |
中危 |
15.5.10 |
15.5.16, 16.2.5 |
Next.js: Next.js: Cache poisoning vulnerability in React Server Components
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44576
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 17:16 修改: 2026-06-17 10:50
|
| next |
CVE-2026-44577 |
中危 |
15.5.10 |
15.5.16, 16.2.5 |
Next.js: Next.js: Denial of Service via Image Optimization API
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44577
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 17:16 修改: 2026-07-16 12:17
|
| undici |
CVE-2026-1525 |
中危 |
7.18.2 |
6.24.0, 7.24.0 |
undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-1525
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 20:16 修改: 2026-06-17 10:15
|
| undici |
CVE-2026-1527 |
中危 |
7.18.2 |
6.24.0, 7.24.0 |
undici: Undici: HTTP header injection and request smuggling vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-1527
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 21:16 修改: 2026-06-17 10:16
|
| undici |
CVE-2026-2581 |
中危 |
7.18.2 |
7.24.0 |
undici: Undici: Denial of Service due to uncontrolled resource consumption
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2581
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-12 21:16 修改: 2026-06-17 10:31
|
| undici |
CVE-2026-9678 |
中危 |
7.18.2 |
7.28.0, 8.5.0 |
undici: Undici: Information disclosure due to improper cache-control header parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9678
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-17 18:18 修改: 2026-06-25 17:44
|
| undici |
CVE-2026-9679 |
中危 |
7.18.2 |
6.27.0, 7.28.0, 8.5.0 |
undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9679
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-17 18:18 修改: 2026-06-25 17:43
|
| uuid |
CVE-2026-41907 |
中危 |
10.0.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
11.1.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
13.0.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
8.3.2 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
9.0.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
9.0.1 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| next |
CVE-2026-44580 |
中危 |
15.5.10 |
15.5.16, 16.2.5 |
next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44580
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 18:16 修改: 2026-06-17 10:50
|
| next |
CVE-2026-44581 |
中危 |
15.5.10 |
15.5.16, 16.2.5 |
next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44581
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 18:16 修改: 2026-06-17 10:50
|
| vite |
CVE-2025-62522 |
中危 |
7.0.5 |
7.1.11, 7.0.8, 6.4.1, 5.4.21 |
vite: vite allows server.fs.deny bypass via backslash on Windows
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-62522
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2025-10-20 20:15 修改: 2026-06-17 09:52
|
| vite |
CVE-2026-39365 |
中危 |
7.0.5 |
8.0.5, 7.3.2, 6.4.2 |
vite: Vite: Information disclosure via path traversal in dev server's .map request handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39365
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-07 20:16 修改: 2026-06-17 10:42
|
| vite |
CVE-2026-53632 |
中危 |
7.0.5 |
8.0.16, 7.3.5, 6.4.3 |
launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53632
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 18:16 修改: 2026-06-23 15:44
|
| next |
CVE-2026-64643 |
中危 |
15.5.10 |
15.5.21, 16.2.11 |
Next.js: Unauthenticated disclosure of internal Server Function endpoints
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64643
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
|
| next |
CVE-2026-64644 |
中危 |
15.5.10 |
15.5.21, 16.2.11 |
Next.js: Denial of Service in the Image Optimization API using SVGs
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-64644
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
|
| ws |
CVE-2026-45736 |
中危 |
8.18.3 |
8.20.1 |
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45736
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-15 15:16 修改: 2026-07-22 12:18
|
| yaml |
CVE-2026-33532 |
中危 |
1.10.2 |
2.8.3, 1.10.3 |
yaml: yaml: Denial of Service via deeply nested YAML document parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33532
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 20:16 修改: 2026-06-17 10:37
|
| yaml |
CVE-2026-33532 |
中危 |
2.8.1 |
2.8.3, 1.10.3 |
yaml: yaml: Denial of Service via deeply nested YAML document parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33532
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 20:16 修改: 2026-06-17 10:37
|
| fast-xml-parser |
CVE-2026-27942 |
低危 |
5.2.5 |
5.3.8, 4.5.4 |
fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27942
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| qs |
CVE-2026-2391 |
低危 |
6.14.1 |
6.14.2 |
qs: qs's arrayLimit bypass in comma parsing allows denial of service
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2391
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-12 05:17 修改: 2026-06-17 10:30
|
| fast-xml-parser |
CVE-2026-27942 |
低危 |
4.5.0 |
5.3.8, 4.5.4 |
fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27942
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| axios |
CVE-2026-42040 |
低危 |
1.12.2 |
1.15.1, 0.31.1 |
axios: Axios: Incorrect null byte handling can lead to data integrity issues
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42040
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-04-24 18:16 修改: 2026-06-17 10:47
|
| body-parser |
CVE-2026-12590 |
低危 |
2.2.1 |
1.20.6, 2.3.0 |
body-parser: body-parser: Denial of Service via invalid limit option
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12590
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-07-09 11:16 修改: 2026-07-10 02:45
|
| next |
CVE-2026-44572 |
低危 |
15.5.10 |
15.5.16, 16.2.5 |
next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44572
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 16:16 修改: 2026-06-17 10:50
|
| tmp |
CVE-2025-54798 |
低危 |
0.2.1 |
0.2.4 |
tmp: tmp Symbolic Link Write Vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-54798
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2025-08-07 01:15 修改: 2026-06-17 09:40
|
| next |
CVE-2026-44582 |
低危 |
15.5.10 |
15.5.16, 16.2.5 |
Next.js: Next.js: Cache poisoning allows incorrect response delivery
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44582
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-13 18:16 修改: 2026-06-17 10:50
|
| @tootallnate/once |
CVE-2026-3449 |
低危 |
2.0.0 |
3.0.1, 2.0.1 |
@tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-3449
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-03 05:17 修改: 2026-06-17 10:43
|
| undici |
CVE-2026-11525 |
低危 |
7.18.2 |
6.27.0, 7.28.0, 8.5.0 |
undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-11525
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-17 18:17 修改: 2026-06-25 17:46
|
| undici |
CVE-2026-6733 |
低危 |
7.18.2 |
6.27.0, 7.28.0, 8.5.0 |
undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6733
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-17 18:18 修改: 2026-06-27 23:46
|
| turbo |
CVE-2026-45772 |
低危 |
2.8.16 |
2.9.14 |
Turbo: Unexpected local code execution during Yarn Berry detection
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45772
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-05-15 16:16 修改: 2026-06-17 10:52
|
| turbo |
CVE-2026-45772 |
低危 |
2.8.16 |
2.9.14 |
Turbo: Unexpected local code execution during Yarn Berry detection
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45772
镜像层: sha256:0fee5d9b422cce53d7fb0ff05e3d2f211eef5395d7b71c75ba35b420ec0b66a8
发布日期: 2026-05-15 16:16 修改: 2026-06-17 10:52
|
| diff |
CVE-2026-24001 |
低危 |
3.5.0 |
8.0.3, 5.2.2, 4.0.4, 3.5.1 |
jsdiff: denial of service vulnerability in parsePatch and applyPatch
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24001
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-01-22 03:15 修改: 2026-07-15 02:18
|
| diff |
CVE-2026-24001 |
低危 |
4.0.2 |
8.0.3, 5.2.2, 4.0.4, 3.5.1 |
jsdiff: denial of service vulnerability in parsePatch and applyPatch
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24001
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-01-22 03:15 修改: 2026-07-15 02:18
|
| fast-xml-parser |
CVE-2026-27942 |
低危 |
4.5.3 |
5.3.8, 4.5.4 |
fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27942
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| fast-xml-parser |
CVE-2026-27942 |
低危 |
4.4.1 |
5.3.8, 4.5.4 |
fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-27942
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-02-26 02:16 修改: 2026-06-17 10:27
|
| nodemailer |
GHSA-c7w3-x93f-qmm8 |
低危 |
7.0.11 |
8.0.4 |
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
漏洞详情: https://github.com/advisories/GHSA-c7w3-x93f-qmm8
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-03-26 22:26 修改: 2026-03-26 22:26
|
| brace-expansion |
CVE-2025-5889 |
低危 |
2.0.1 |
2.0.2, 1.1.12, 3.0.1, 4.0.1 |
brace-expansion: juliangruber brace-expansion index.js expand redos
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-5889
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2025-06-09 19:15 修改: 2026-06-17 09:48
|
| brace-expansion |
CVE-2025-5889 |
低危 |
2.0.1 |
2.0.2, 1.1.12, 3.0.1, 4.0.1 |
brace-expansion: juliangruber brace-expansion index.js expand redos
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-5889
镜像层: sha256:09f67860d7255c29531f73a48ec21d53e9a347a368646b45a693c992ab3beb68
发布日期: 2025-06-09 19:15 修改: 2026-06-17 09:48
|
| @babel/core |
CVE-2026-49356 |
低危 |
7.28.5 |
8.0.0-rc.6, 7.29.6 |
@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-49356
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-22 18:16 修改: 2026-06-26 20:04
|
| undici |
CVE-2026-11525 |
低危 |
6.21.3 |
6.27.0, 7.28.0, 8.5.0 |
undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-11525
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-17 18:17 修改: 2026-06-25 17:46
|
| vite |
CVE-2025-58751 |
低危 |
7.0.5 |
7.1.5, 7.0.7, 6.3.6, 5.4.20 |
vitejs/vite: lukeed/sirv: Vite middleware may serve files starting with the same name with the public directory
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-58751
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2025-09-08 23:15 修改: 2026-06-17 09:44
|
| vite |
CVE-2025-58752 |
低危 |
7.0.5 |
7.1.5, 7.0.7, 6.3.6, 5.4.20 |
vite: Vite's `server.fs` settings were not applied to HTML files
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-58752
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2025-09-08 23:15 修改: 2026-06-17 09:44
|
| undici |
CVE-2026-6733 |
低危 |
6.21.3 |
6.27.0, 7.28.0, 8.5.0 |
undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6733
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-06-17 18:18 修改: 2026-06-27 23:46
|
| brace-expansion |
CVE-2025-5889 |
低危 |
1.1.11 |
2.0.2, 1.1.12, 3.0.1, 4.0.1 |
brace-expansion: juliangruber brace-expansion index.js expand redos
漏洞详情: https://avd.aquasec.com/nvd/cve-2025-5889
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2025-06-09 19:15 修改: 2026-06-17 09:48
|
| @smithy/config-resolver |
GHSA-6475-r3vj-m8vf |
低危 |
3.0.9 |
4.4.0 |
AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value
漏洞详情: https://github.com/advisories/GHSA-6475-r3vj-m8vf
镜像层: sha256:258a9fd6ae4b00a4d632996fc7912af43557ee1982cbf424cac607e00d8b6abc
发布日期: 2026-01-08 21:52 修改: 2026-01-08 21:52
|
| undici |
CVE-2026-11525 |
低危 |
6.25.0 |
6.27.0, 7.28.0, 8.5.0 |
undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-11525
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-06-17 18:17 修改: 2026-06-25 17:46
|
| undici |
CVE-2026-6733 |
低危 |
6.25.0 |
6.27.0, 7.28.0, 8.5.0 |
undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6733
镜像层: sha256:6966e360c462d50cda6c02920293f497cf6c749d0a3149307c9088a33530860f
发布日期: 2026-06-17 18:18 修改: 2026-06-27 23:46
|