docker.io/moonrailgun/tianji:1.32.31 linux/amd64

docker.io/moonrailgun/tianji:1.32.31 - Trivy安全扫描结果 扫描时间: 2026-09-02 11:52
全部漏洞信息
低危漏洞:10 中危漏洞:36 高危漏洞:30 严重漏洞:4

系统OS: alpine 3.23.4 扫描引擎: Trivy 扫描时间: 2026-09-02 11:52

docker.io/moonrailgun/tianji:1.32.31 (alpine 3.23.4) (alpine)
低危漏洞:0 中危漏洞:0 高危漏洞:0 严重漏洞:0
软件包 漏洞 安全状态 安装版本 修复版本 漏洞信息
Node.js (node-pkg)
低危漏洞:10 中危漏洞:35 高危漏洞:22 严重漏洞:4
软件包 漏洞 安全状态 安装版本 修复版本 漏洞信息
@auth/core CVE-2026-73420 严重 0.34.3 0.41.3 Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-73420

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-13 22:17 修改: 2026-08-14 16:17
vm2 CVE-2026-47686 严重 3.11.5 3.11.6 VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-47686

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-17 21:16 修改: 2026-08-19 04:17
vm2 CVE-2026-47698 严重 3.11.5 3.11.6 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-47698

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-17 21:16 修改: 2026-08-19 04:17
vm2 GHSA-m5w8-4gq2-6f8x 严重 3.11.5 3.11.6 vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

漏洞详情: https://github.com/advisories/GHSA-m5w8-4gq2-6f8x

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-17 17:32 修改: 2026-08-17 17:32
brace-expansion CVE-2026-14257 高危 1.1.11 5.0.8, 3.0.3, 2.1.3, 1.1.17 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-14257

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-23 14:17 修改: 2026-08-27 18:52
brace-expansion CVE-2026-69152 高危 1.1.11 1.1.18, 2.1.4, 3.0.6, 5.0.9 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-69152

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-03 17:16 修改: 2026-08-05 14:58
engine.io CVE-2026-59724 高危 6.6.4 6.6.7 engine.io: Engine.IO: Denial of Service via crafted WebTransport session ID

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59724

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-08 16:16 修改: 2026-07-13 15:08
engine.io CVE-2026-59725 高危 6.6.4 6.6.7 socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59725

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-08 16:16 修改: 2026-07-13 15:07
extract-zip CVE-2026-56876 高危 2.0.1 extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-56876

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-06-26 18:17 修改: 2026-07-06 13:25
ip-address CVE-2026-69192 高危 9.0.5 10.3.1 ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-69192

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-03 20:17 修改: 2026-08-04 15:16
js-yaml CVE-2026-59869 高危 4.1.0 3.15.0, 4.3.0 js-yaml: js-yaml: Denial of Service via crafted YAML documents

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59869

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-08 16:16 修改: 2026-07-13 15:05
js-yaml GHSA-5p4m-2wfm-xmqj 高危 4.1.0 4.3.1, 3.15.1 JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

漏洞详情: https://github.com/advisories/GHSA-5p4m-2wfm-xmqj

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-06 20:27 修改: 2026-08-06 20:27
nanoid CVE-2026-67213 高危 3.3.9 3.3.18, 5.1.6 nanoid: nanoid: Denial of Service via infinite loop in random ID generation

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-67213

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-29 14:16 修改: 2026-08-18 14:26
nanoid CVE-2026-67214 高危 3.3.9 3.3.16, 5.1.16 nanoid: nanoid: Denial of Service via negative size input in non-secure module functions

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-67214

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-29 14:16 修改: 2026-08-26 17:53
nanoid CVE-2026-67213 高危 5.1.3 3.3.18, 5.1.6 nanoid: nanoid: Denial of Service via infinite loop in random ID generation

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-67213

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-29 14:16 修改: 2026-08-18 14:26
nanoid CVE-2026-67214 高危 5.1.3 3.3.16, 5.1.16 nanoid: nanoid: Denial of Service via negative size input in non-secure module functions

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-67214

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-29 14:16 修改: 2026-08-26 17:53
nodemailer GHSA-p6gq-j5cr-w38f 高危 7.0.13 9.0.1 Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

漏洞详情: https://github.com/advisories/GHSA-p6gq-j5cr-w38f

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-06-18 14:28 修改: 2026-06-18 14:28
postcss CVE-2026-45623 高危 8.5.3 8.5.12 postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45623

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-27 18:16 修改: 2026-08-07 00:13
postcss CVE-2026-73646 高危 8.5.3 8.5.18 postcss: PostCSS: Information disclosure via path traversal in source map auto-loading

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-73646

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-17 16:17 修改: 2026-08-17 17:16
shell-quote CVE-2026-13311 高危 1.8.4 1.9.0 shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13311

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-06-25 05:16 修改: 2026-06-26 19:03
socket.io-parser CVE-2026-69185 高危 4.2.6 4.2.7, 3.4.5, 3.3.6 socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packets

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-69185

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-03 20:17 修改: 2026-08-03 21:16
@auth/core CVE-2026-73418 高危 0.34.3 0.41.3 Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-73418

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-12 21:17 修改: 2026-08-13 13:19
axios GHSA-gcfj-64vw-6mp9 高危 1.16.0 0.33.0, 1.18.0 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

漏洞详情: https://github.com/advisories/GHSA-gcfj-64vw-6mp9

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-20 22:40 修改: 2026-07-20 22:40
brace-expansion CVE-2026-13149 高危 1.1.11 5.0.7, 1.1.16, 2.1.2 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-13149

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-06-30 10:16 修改: 2026-07-08 12:17
vm2 CVE-2026-47683 高危 3.11.5 3.11.6 vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-47683

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-17 21:16 修改: 2026-08-18 16:17
vm2 GHSA-v836-6xw4-9cx3 高危 3.11.5 3.11.6 vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

漏洞详情: https://github.com/advisories/GHSA-v836-6xw4-9cx3

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-17 17:32 修改: 2026-08-17 17:32
axios GHSA-hcpx-6fm6-wx23 中危 1.16.0 0.33.0, 1.18.0 Axios form serializer maxDepth bypass via {} metatoken

漏洞详情: https://github.com/advisories/GHSA-hcpx-6fm6-wx23

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-20 22:38 修改: 2026-07-20 22:38
js-yaml CVE-2025-64718 中危 4.1.0 4.1.1, 3.14.2 js-yaml: js-yaml prototype pollution in merge

漏洞详情: https://avd.aquasec.com/nvd/cve-2025-64718

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2025-11-13 16:15 修改: 2026-06-17 09:55
js-yaml CVE-2026-53550 中危 4.1.0 4.2.0, 3.15.0 js-yaml: js-yaml: Denial of Service via crafted YAML merge keys

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53550

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-06-22 16:16 修改: 2026-07-09 20:33
morgan CVE-2026-5078 中危 1.10.0 1.11.0 morgan: morgan: Log forgery due to unneutralized control characters

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-5078

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-06-03 08:16 修改: 2026-07-22 19:10
mysql2 GHSA-rgwj-5xj2-c3m3 中危 3.14.3 3.23.1 MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

漏洞详情: https://github.com/advisories/GHSA-rgwj-5xj2-c3m3

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-31 22:36 修改: 2026-08-31 22:36
axios GHSA-jqh4-m9w3-8hp9 中危 1.16.0 1.18.0 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

漏洞详情: https://github.com/advisories/GHSA-jqh4-m9w3-8hp9

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-20 22:27 修改: 2026-07-20 22:27
axios GHSA-mwf2-3pr3-8698 中危 1.16.0 1.18.0 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

漏洞详情: https://github.com/advisories/GHSA-mwf2-3pr3-8698

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-20 22:37 修改: 2026-07-20 22:37
ajv CVE-2025-69873 中危 6.12.6 8.18.0, 6.14.0 ajv: ReDoS via $data reference

漏洞详情: https://avd.aquasec.com/nvd/cve-2025-69873

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-02-11 19:15 修改: 2026-08-24 13:17
@auth/core CVE-2026-73419 中危 0.34.3 0.41.3 Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-73419

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-12 21:17 修改: 2026-08-13 16:19
axios CVE-2026-67312 中危 1.16.0 0.33.0, 1.18.0 axios: axios: Denial of Service via uncontrolled recursion in form data processing

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-67312

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-01 13:17 修改: 2026-08-31 20:25
nodemailer GHSA-268h-hp4c-crq3 中危 7.0.13 8.0.9 Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

漏洞详情: https://github.com/advisories/GHSA-268h-hp4c-crq3

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-06-15 17:36 修改: 2026-06-15 17:36
nodemailer GHSA-r7g4-qg5f-qqm2 中危 7.0.13 8.0.8 Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

漏洞详情: https://github.com/advisories/GHSA-r7g4-qg5f-qqm2

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-06-15 17:34 修改: 2026-06-15 17:34
nodemailer GHSA-vvjj-xcjg-gr5g 中危 7.0.13 8.0.5 Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)

漏洞详情: https://github.com/advisories/GHSA-vvjj-xcjg-gr5g

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-04-08 15:05 修改: 2026-04-08 15:05
nodemailer GHSA-wqvq-jvpq-h66f 中危 7.0.13 8.0.9 Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

漏洞详情: https://github.com/advisories/GHSA-wqvq-jvpq-h66f

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-06-15 17:35 修改: 2026-06-15 17:35
brace-expansion CVE-2026-33750 中危 1.1.11 5.0.5, 3.0.2, 2.0.3, 1.1.13 brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33750

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-03-27 15:16 修改: 2026-06-17 10:38
axios CVE-2026-67314 中危 1.16.0 1.18.0 axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-67314

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-01 13:17 修改: 2026-08-31 20:25
postcss CVE-2026-41305 中危 8.5.3 8.5.10 postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41305

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-04-24 03:16 修改: 2026-06-17 10:46
postcss CVE-2026-69153 中危 8.5.3 8.5.23 postcss: PostCSS: Information disclosure via crafted sourceMappingURL

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-69153

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-03 17:16 修改: 2026-08-05 14:58
qs CVE-2025-15284 中危 6.13.0 6.14.1 qs: qs: Denial of Service via improper input validation in array parsing

漏洞详情: https://avd.aquasec.com/nvd/cve-2025-15284

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2025-12-29 23:15 修改: 2026-06-17 08:37
qs CVE-2026-8723 中危 6.13.0 6.15.2 qs: qs: Denial of Service due to improper handling of null/undefined array elements

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8723

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-05-17 00:16 修改: 2026-06-17 11:04
qs CVE-2025-15284 中危 6.14.0 6.14.1 qs: qs: Denial of Service via improper input validation in array parsing

漏洞详情: https://avd.aquasec.com/nvd/cve-2025-15284

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2025-12-29 23:15 修改: 2026-06-17 08:37
qs CVE-2026-8723 中危 6.14.0 6.15.2 qs: qs: Denial of Service due to improper handling of null/undefined array elements

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8723

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-05-17 00:16 修改: 2026-06-17 11:04
qs CVE-2025-15284 中危 6.5.3 6.14.1 qs: qs: Denial of Service via improper input validation in array parsing

漏洞详情: https://avd.aquasec.com/nvd/cve-2025-15284

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2025-12-29 23:15 修改: 2026-06-17 08:37
request CVE-2023-28155 中危 2.88.2 request: bypass of SSRF mitigations when following a cross-protocol redirect

漏洞详情: https://avd.aquasec.com/nvd/cve-2023-28155

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2023-03-16 15:15 修改: 2026-06-17 05:46
axios CVE-2026-67316 中危 1.16.0 1.18.0, 0.33.0 axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-67316

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-08-01 13:17 修改: 2026-08-31 20:25
axios GHSA-42h9-826w-cgv3 中危 1.16.0 0.33.0, 1.18.0 Axios: Excessive recursion in formDataToJSON can cause denial of service

漏洞详情: https://github.com/advisories/GHSA-42h9-826w-cgv3

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-20 17:58 修改: 2026-07-20 17:58
tough-cookie CVE-2023-26136 中危 2.5.0 4.1.3 tough-cookie: prototype pollution in cookie memstore

漏洞详情: https://avd.aquasec.com/nvd/cve-2023-26136

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2023-07-01 05:15 修改: 2026-06-17 05:42
uuid CVE-2026-41907 中危 3.4.0 11.1.1, 12.0.1, 13.0.1 uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
uuid CVE-2026-41907 中危 9.0.1 11.1.1, 12.0.1, 13.0.1 uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
h3 GHSA-4hxc-9384-m385 中危 1.15.6 2.0.1-rc.17, 1.15.9 h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)

漏洞详情: https://github.com/advisories/GHSA-4hxc-9384-m385

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-03-20 20:50 修改: 2026-03-20 20:50
h3 GHSA-72gr-qfp7-vwhw 中危 1.15.6 1.15.9 h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`

漏洞详情: https://github.com/advisories/GHSA-72gr-qfp7-vwhw

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-03-20 20:50 修改: 2026-03-20 20:50
axios GHSA-7q8q-rj6j-mhjq 中危 1.16.0 0.33.0, 1.18.0 Axios: Nested axios option objects can consume polluted prototype values

漏洞详情: https://github.com/advisories/GHSA-7q8q-rj6j-mhjq

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-20 22:37 修改: 2026-07-20 22:37
ip-address CVE-2026-42338 中危 9.0.5 10.1.1 ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42338

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-05-12 20:16 修改: 2026-08-28 16:17
axios GHSA-f4gw-2p7v-4548 中危 1.16.0 1.18.0, 0.33.0 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

漏洞详情: https://github.com/advisories/GHSA-f4gw-2p7v-4548

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-20 22:20 修改: 2026-07-20 22:20
yaml CVE-2026-33532 中危 2.7.0 2.8.3, 1.10.3 yaml: yaml: Denial of Service via deeply nested YAML document parsing

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33532

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-03-26 20:16 修改: 2026-06-17 10:37
body-parser CVE-2026-12590 低危 1.20.3 1.20.6, 2.3.0 body-parser: body-parser: Denial of Service via invalid limit option

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12590

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-07-09 11:16 修改: 2026-07-10 02:45
ai CVE-2025-48985 低危 5.0.15 5.0.52, 5.1.0-beta.9 Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

漏洞详情: https://avd.aquasec.com/nvd/cve-2025-48985

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2025-11-07 01:15 修改: 2026-06-17 09:30
brace-expansion CVE-2025-5889 低危 1.1.11 2.0.2, 1.1.12, 3.0.1, 4.0.1 brace-expansion: juliangruber brace-expansion index.js expand redos

漏洞详情: https://avd.aquasec.com/nvd/cve-2025-5889

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2025-06-09 19:15 修改: 2026-06-17 09:48
qs CVE-2026-2391 低危 6.13.0 6.14.2 qs: qs's arrayLimit bypass in comma parsing allows denial of service

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2391

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-02-12 05:17 修改: 2026-06-17 10:30
nodemailer GHSA-c7w3-x93f-qmm8 低危 7.0.13 8.0.4 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter

漏洞详情: https://github.com/advisories/GHSA-c7w3-x93f-qmm8

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-03-26 22:26 修改: 2026-03-26 22:26
on-headers CVE-2025-7339 低危 1.0.2 1.1.0 on-headers: on-headers vulnerable to http response header manipulation

漏洞详情: https://avd.aquasec.com/nvd/cve-2025-7339

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2025-07-17 16:15 修改: 2026-06-17 10:04
qs CVE-2026-2391 低危 6.14.0 6.14.2 qs: qs's arrayLimit bypass in comma parsing allows denial of service

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-2391

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-02-12 05:17 修改: 2026-06-17 10:30
cookie CVE-2024-47764 低危 0.6.0 0.7.0 cookie: cookie accepts cookie name, path, and domain with out of bounds characters

漏洞详情: https://avd.aquasec.com/nvd/cve-2024-47764

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2024-10-04 20:15 修改: 2026-06-17 07:57
diff CVE-2026-24001 低危 4.0.2 8.0.3, 5.2.2, 4.0.4, 3.5.1 jsdiff: denial of service vulnerability in parsePatch and applyPatch

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-24001

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-01-22 03:15 修改: 2026-07-15 02:18
@ai-sdk/provider-utils CVE-2026-8769 低危 3.0.3 @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8769

镜像层: sha256:a5bb4c2ccebd44f25307ee3cef5d9881d82dcecb26e4ce713885d2cad3eaffc6

发布日期: 2026-05-17 23:17 修改: 2026-06-17 11:04
Python (python-pkg)
低危漏洞:0 中危漏洞:0 高危漏洞:0 严重漏洞:0
软件包 漏洞 安全状态 安装版本 修复版本 漏洞信息
usr/local/bin/tianji-reporter (gobinary)
低危漏洞:0 中危漏洞:1 高危漏洞:8 严重漏洞:0
软件包 漏洞 安全状态 安装版本 修复版本 漏洞信息
stdlib CVE-2026-33818 高危 v1.25.11 1.25.13, 1.26.6, 1.27.0-rc.3 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33818

镜像层: sha256:8d7164f91677debbfeded7ee8d9f8c1b85d2c2b6c88f7ad9b54542dd3d002e56

发布日期: 2026-08-13 22:17 修改: 2026-08-14 16:16
stdlib CVE-2026-39821 高危 v1.25.11 1.25.13, 1.26.6, 1.27.0-rc.3 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39821

镜像层: sha256:8d7164f91677debbfeded7ee8d9f8c1b85d2c2b6c88f7ad9b54542dd3d002e56

发布日期: 2026-05-22 16:16 修改: 2026-08-31 13:18
stdlib CVE-2026-39822 高危 v1.25.11 1.25.12, 1.26.5, 1.27.0-rc.2 golang: Go os.Root: Symlink following vulnerability allows directory traversal

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39822

镜像层: sha256:8d7164f91677debbfeded7ee8d9f8c1b85d2c2b6c88f7ad9b54542dd3d002e56

发布日期: 2026-07-08 17:17 修改: 2026-07-13 14:54
stdlib CVE-2026-56853 高危 v1.25.11 1.25.13, 1.26.6, 1.27.0-rc.3 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-56853

镜像层: sha256:8d7164f91677debbfeded7ee8d9f8c1b85d2c2b6c88f7ad9b54542dd3d002e56

发布日期: 2026-08-13 22:17 修改: 2026-08-14 16:16
stdlib CVE-2026-56858 高危 v1.25.11 1.25.13, 1.26.6, 1.27.0-rc.3 html/template: golang: Go html/template: Cross-Site Scripting via pathological input

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-56858

镜像层: sha256:8d7164f91677debbfeded7ee8d9f8c1b85d2c2b6c88f7ad9b54542dd3d002e56

发布日期: 2026-08-13 22:17 修改: 2026-08-14 16:16
stdlib CVE-2026-56859 高危 v1.25.11 1.25.13, 1.26.6, 1.27.0-rc.3 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-56859

镜像层: sha256:8d7164f91677debbfeded7ee8d9f8c1b85d2c2b6c88f7ad9b54542dd3d002e56

发布日期: 2026-08-13 22:17 修改: 2026-08-14 16:16
stdlib CVE-2026-56860 高危 v1.25.11 1.25.13, 1.26.6, 1.27.0-rc.3 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-56860

镜像层: sha256:8d7164f91677debbfeded7ee8d9f8c1b85d2c2b6c88f7ad9b54542dd3d002e56

发布日期: 2026-08-13 22:17 修改: 2026-08-14 17:19
stdlib CVE-2026-56862 高危 v1.25.11 1.25.13, 1.26.6, 1.27.0-rc.3 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-56862

镜像层: sha256:8d7164f91677debbfeded7ee8d9f8c1b85d2c2b6c88f7ad9b54542dd3d002e56

发布日期: 2026-08-13 22:17 修改: 2026-08-14 16:16
stdlib CVE-2026-42505 中危 v1.25.11 1.25.12, 1.26.5, 1.27.0-rc.2 crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42505

镜像层: sha256:8d7164f91677debbfeded7ee8d9f8c1b85d2c2b6c88f7ad9b54542dd3d002e56

发布日期: 2026-07-08 17:17 修改: 2026-07-13 17:05
golang.org/x/sys CVE-2026-39824 未知 v0.28.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39824

镜像层: sha256:8d7164f91677debbfeded7ee8d9f8c1b85d2c2b6c88f7ad9b54542dd3d002e56

发布日期: 2026-05-22 20:16 修改: 2026-07-23 16:10
检测到您正在使用广告拦截插件，本站为公益站点，依赖广告维持运转 🙏 查看如何关闭 ×