| @hapi/content |
CVE-2026-44974 |
高危 |
6.0.1 |
6.0.2 |
@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44974
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-17 20:17 修改: 2026-07-17 20:17
|
| axios |
CVE-2026-44486 |
高危 |
1.15.2 |
1.16.0, 0.32.0 |
axios: Axios: Information disclosure of proxy credentials via HTTP redirects
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44486
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-11 17:16 修改: 2026-07-17 13:18
|
| axios |
CVE-2026-44487 |
高危 |
1.15.2 |
1.16.0, 0.32.0 |
axios: Axios: Information disclosure of proxy credentials via redirect flows
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44487
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-11 17:16 修改: 2026-07-17 13:18
|
| axios |
CVE-2026-44488 |
高危 |
1.15.2 |
1.16.0 |
axios: Axios: Denial of Service due to unenforced request and response size limits
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44488
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-11 17:16 修改: 2026-07-17 13:18
|
| axios |
CVE-2026-44492 |
高危 |
1.15.2 |
1.16.0, 0.32.0 |
axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44492
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-11 17:16 修改: 2026-07-17 13:18
|
| axios |
CVE-2026-44494 |
高危 |
1.15.2 |
1.16.0 |
axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44494
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-11 17:16 修改: 2026-07-17 13:18
|
| axios |
CVE-2026-44496 |
高危 |
1.15.2 |
1.16.0, 0.32.0 |
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44496
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-11 17:16 修改: 2026-07-17 13:18
|
| basic-ftp |
CVE-2026-44240 |
高危 |
5.3.0 |
5.3.1 |
basic-ftp: basic-ftp: Client-side Denial of Service via unterminated multiline FTP responses
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44240
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-05-12 21:16 修改: 2026-06-17 10:50
|
| fast-uri |
CVE-2026-6321 |
高危 |
3.1.0 |
3.1.1 |
fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6321
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-05-04 20:16 修改: 2026-07-16 12:18
|
| fast-uri |
CVE-2026-6322 |
高危 |
3.1.0 |
3.1.2 |
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6322
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-05-05 11:16 修改: 2026-07-17 13:19
|
| form-data |
CVE-2026-12143 |
高危 |
4.0.4 |
2.5.6, 3.0.5, 4.0.6 |
form-data: form-data: Form field override via CRLF injection
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12143
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-12 19:16 修改: 2026-07-17 13:17
|
| form-data |
CVE-2026-12143 |
高危 |
4.0.5 |
2.5.6, 3.0.5, 4.0.6 |
form-data: form-data: Form field override via CRLF injection
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12143
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-12 19:16 修改: 2026-07-17 13:17
|
| form-data |
CVE-2026-12143 |
高危 |
4.0.5 |
2.5.6, 3.0.5, 4.0.6 |
form-data: form-data: Form field override via CRLF injection
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12143
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-12 19:16 修改: 2026-07-17 13:17
|
| form-data |
CVE-2026-12143 |
高危 |
4.0.5 |
2.5.6, 3.0.5, 4.0.6 |
form-data: form-data: Form field override via CRLF injection
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12143
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-12 19:16 修改: 2026-07-17 13:17
|
| js-cookie |
CVE-2026-46625 |
高危 |
2.2.1 |
3.0.7 |
js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-46625
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-10 22:16 修改: 2026-07-15 02:22
|
| linkify-it |
CVE-2026-48801 |
高危 |
3.0.3 |
5.0.1 |
linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48801
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-14 21:17 修改: 2026-07-15 20:21
|
| ws |
CVE-2026-48779 |
高危 |
7.5.10 |
5.2.5, 6.2.4, 7.5.11, 8.21.0 |
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48779
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-17 13:20 修改: 2026-07-17 13:18
|
| ws |
CVE-2026-48779 |
高危 |
8.20.0 |
5.2.5, 6.2.4, 7.5.11, 8.21.0 |
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48779
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-17 13:20 修改: 2026-07-17 13:18
|
| ws |
CVE-2026-48779 |
高危 |
8.20.0 |
5.2.5, 6.2.4, 7.5.11, 8.21.0 |
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48779
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-17 13:20 修改: 2026-07-17 13:18
|
| dompurify |
GHSA-cmwh-pvxp-8882 |
中危 |
3.4.1 |
3.4.11 |
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
漏洞详情: https://github.com/advisories/GHSA-cmwh-pvxp-8882
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-18 14:27 修改: 2026-06-18 14:27
|
| dompurify |
GHSA-cmwh-pvxp-8882 |
中危 |
3.4.7 |
3.4.11 |
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
漏洞详情: https://github.com/advisories/GHSA-cmwh-pvxp-8882
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-18 14:27 修改: 2026-06-18 14:27
|
| dompurify |
GHSA-cmwh-pvxp-8882 |
中危 |
3.4.7 |
3.4.11 |
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
漏洞详情: https://github.com/advisories/GHSA-cmwh-pvxp-8882
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-18 14:27 修改: 2026-06-18 14:27
|
| dompurify |
GHSA-cmwh-pvxp-8882 |
中危 |
3.4.7 |
3.4.11 |
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
漏洞详情: https://github.com/advisories/GHSA-cmwh-pvxp-8882
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-18 14:27 修改: 2026-06-18 14:27
|
| dompurify |
GHSA-cmwh-pvxp-8882 |
中危 |
3.4.8 |
3.4.11 |
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
漏洞详情: https://github.com/advisories/GHSA-cmwh-pvxp-8882
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-18 14:27 修改: 2026-06-18 14:27
|
| echarts |
CVE-2026-45249 |
中危 |
6.0.0 |
6.1.0 |
Apache ECharts has a cross-site scripting (XSS) vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45249
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-05-25 08:16 修改: 2026-06-17 10:51
|
| echarts |
CVE-2026-45249 |
中危 |
6.0.0 |
6.1.0 |
Apache ECharts has a cross-site scripting (XSS) vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45249
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-05-25 08:16 修改: 2026-06-17 10:51
|
| echarts |
CVE-2026-45249 |
中危 |
6.0.0 |
6.1.0 |
Apache ECharts has a cross-site scripting (XSS) vulnerability
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45249
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-05-25 08:16 修改: 2026-06-17 10:51
|
| @hapi/wreck |
CVE-2026-44979 |
中危 |
17.2.0 |
18.1.1 |
@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44979
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-17 22:17 修改: 2026-07-17 22:17
|
| @hapi/wreck |
CVE-2026-44979 |
中危 |
17.2.0 |
18.1.1 |
@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44979
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-17 22:17 修改: 2026-07-17 22:17
|
| @hapi/wreck |
CVE-2026-48022 |
中危 |
17.2.0 |
18.1.2 |
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48022
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-17 22:17 修改: 2026-07-17 22:17
|
| @hapi/wreck |
CVE-2026-48022 |
中危 |
17.2.0 |
18.1.2 |
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48022
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-17 22:17 修改: 2026-07-17 22:17
|
| @opentelemetry/core |
CVE-2026-54285 |
中危 |
1.30.1 |
2.8.0 |
@opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54285
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-22 18:16 修改: 2026-06-23 16:17
|
| axios |
CVE-2026-44490 |
中危 |
1.15.2 |
1.16.0, 0.32.0 |
axios: Axios: Information disclosure and denial of service due to prototype pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44490
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-11 17:16 修改: 2026-06-17 10:50
|
| ip-address |
CVE-2026-42338 |
中危 |
10.1.0 |
10.1.1 |
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42338
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-05-12 20:16 修改: 2026-07-16 12:17
|
| joi |
CVE-2026-48038 |
中危 |
14.3.1 |
18.2.1, 17.13.4 |
joi: joi: Denial of Service via uncaught RangeError on deeply nested input through recursive link() schemas
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48038
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-14 20:17 修改: 2026-07-15 20:22
|
| @hapi/inert |
CVE-2026-48049 |
中危 |
6.0.5 |
7.1.1 |
@hapi/inert has a static-file confinement bypass via sibling-prefix path
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48049
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-17 22:17 修改: 2026-07-17 22:17
|
| js-yaml |
CVE-2026-53550 |
中危 |
4.1.1 |
4.2.0, 3.15.0 |
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53550
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-22 16:16 修改: 2026-07-09 20:33
|
| js-yaml |
CVE-2026-53550 |
中危 |
4.1.1 |
4.2.0, 3.15.0 |
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53550
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-22 16:16 修改: 2026-07-09 20:33
|
| json-2-csv |
CVE-2026-9673 |
中危 |
3.20.0 |
5.5.11 |
json-2-csv: json-2-csv: CSV Injection vulnerability allows arbitrary code execution via `preventCsvInjection` bypass.
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9673
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-05-28 06:16 修改: 2026-07-03 16:16
|
| dompurify |
CVE-2026-49458 |
中危 |
3.4.1 |
3.4.6 |
dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-49458
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-14 21:17 修改: 2026-07-15 20:15
|
| showdown |
CVE-2024-1899 |
中危 |
2.1.0 |
|
Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2024-1899
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2024-02-26 19:15 修改: 2026-06-17 07:05
|
| tar |
CVE-2026-53655 |
中危 |
7.5.11 |
7.5.16 |
node-tar: node-tar: File smuggling due to inconsistent tar archive parsing
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-53655
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-22 16:16 修改: 2026-06-26 20:03
|
| uuid |
CVE-2026-41907 |
中危 |
10.0.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
10.0.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
3.3.2 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
3.3.2 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
3.4.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
3.4.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
9.0.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| uuid |
CVE-2026-41907 |
中危 |
9.0.0 |
11.1.1, 12.0.1, 13.0.1 |
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-41907
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-04-24 19:17 修改: 2026-06-17 10:47
|
| dompurify |
CVE-2026-49459 |
中危 |
3.4.1 |
3.4.6 |
dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-49459
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-14 21:17 修改: 2026-07-15 20:15
|
| dompurify |
CVE-2026-49978 |
中危 |
3.4.1 |
3.4.7 |
dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-49978
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-07-14 21:17 修改: 2026-07-15 20:15
|
| dompurify |
GHSA-76mc-f452-cxcm |
中危 |
3.4.1 |
3.4.7 |
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
漏洞详情: https://github.com/advisories/GHSA-76mc-f452-cxcm
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 19:59 修改: 2026-06-15 19:59
|
| ws |
CVE-2026-45736 |
中危 |
8.20.0 |
8.20.1 |
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45736
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-05-15 15:16 修改: 2026-07-15 02:22
|
| ws |
CVE-2026-45736 |
中危 |
8.20.0 |
8.20.1 |
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45736
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-05-15 15:16 修改: 2026-07-15 02:22
|
| dompurify |
GHSA-gvmj-g25r-r7wr |
低危 |
3.4.7 |
3.4.8 |
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
漏洞详情: https://github.com/advisories/GHSA-gvmj-g25r-r7wr
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 20:02 修改: 2026-06-15 20:02
|
| dompurify |
GHSA-gvmj-g25r-r7wr |
低危 |
3.4.7 |
3.4.8 |
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
漏洞详情: https://github.com/advisories/GHSA-gvmj-g25r-r7wr
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 20:02 修改: 2026-06-15 20:02
|
| dompurify |
GHSA-gvmj-g25r-r7wr |
低危 |
3.4.7 |
3.4.8 |
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
漏洞详情: https://github.com/advisories/GHSA-gvmj-g25r-r7wr
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 20:02 修改: 2026-06-15 20:02
|
| dompurify |
GHSA-vxr8-fq34-vvx9 |
低危 |
3.4.7 |
3.4.9 |
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
漏洞详情: https://github.com/advisories/GHSA-vxr8-fq34-vvx9
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 20:12 修改: 2026-06-15 20:12
|
| dompurify |
GHSA-vxr8-fq34-vvx9 |
低危 |
3.4.7 |
3.4.9 |
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
漏洞详情: https://github.com/advisories/GHSA-vxr8-fq34-vvx9
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 20:12 修改: 2026-06-15 20:12
|
| dompurify |
GHSA-vxr8-fq34-vvx9 |
低危 |
3.4.7 |
3.4.9 |
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
漏洞详情: https://github.com/advisories/GHSA-vxr8-fq34-vvx9
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 20:12 修改: 2026-06-15 20:12
|
| dompurify |
GHSA-gvmj-g25r-r7wr |
低危 |
3.4.1 |
3.4.8 |
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
漏洞详情: https://github.com/advisories/GHSA-gvmj-g25r-r7wr
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 20:02 修改: 2026-06-15 20:02
|
| dompurify |
GHSA-vxr8-fq34-vvx9 |
低危 |
3.4.8 |
3.4.9 |
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
漏洞详情: https://github.com/advisories/GHSA-vxr8-fq34-vvx9
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 20:12 修改: 2026-06-15 20:12
|
| dompurify |
GHSA-vxr8-fq34-vvx9 |
低危 |
3.4.1 |
3.4.9 |
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
漏洞详情: https://github.com/advisories/GHSA-vxr8-fq34-vvx9
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 20:12 修改: 2026-06-15 20:12
|
| dompurify |
GHSA-x4vx-rjvf-j5p4 |
低危 |
3.4.1 |
|
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
漏洞详情: https://github.com/advisories/GHSA-x4vx-rjvf-j5p4
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-15 20:00 修改: 2026-06-15 20:00
|
| @tootallnate/once |
CVE-2026-3449 |
低危 |
2.0.0 |
3.0.1, 2.0.1 |
@tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-3449
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-03-03 05:17 修改: 2026-06-17 10:43
|
| @tootallnate/once |
CVE-2026-3449 |
低危 |
2.0.0 |
3.0.1, 2.0.1 |
@tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-3449
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-03-03 05:17 修改: 2026-06-17 10:43
|
| axios |
CVE-2026-44489 |
低危 |
1.15.2 |
1.16.0 |
axios: Axios: Information disclosure via Prototype Pollution
漏洞详情: https://avd.aquasec.com/nvd/cve-2026-44489
镜像层: sha256:bebd5608caac1d51869a38bb7e6899f980cfd35f3171f46eb7aca5d3b6b2c3bc
发布日期: 2026-06-11 17:16 修改: 2026-06-17 10:50
|