CVE-2026-39805

CVE-2026-39805 describes an HTTP request smuggling flaw in Elixir Bandit (bandit) due to Bandit.Headers:get_content_length/1 using List.keyfind/3. If a request carries two Content-Length headers with different values, Bandit may read the body using the first value and dispatch the remaining bytes...

EEF-CVE-2026-42786 WebSocket fragmented message reassembly unbounded in bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The fragment reassembly path in 'Elixir.Bandit.WebSocket.Connection':handleframe/3 in lib/bandit/websocket/connection.ex appends ever...

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in versions of dify prior to 1.11.0, which stems from an API key being exposed in plaintext to the front-end, which could lead to unauthorized access to third-party services...

Mammoth 安全漏洞

Mammoth is a tool for converting Word documents to HTML by the individual developer Michael Williamson. A security vulnerability exists in mammoth version 0.3.25 and versions prior to 1.11.0, which stems from a lack of path or file type validation when processing docx files, and could lead to a...

CVE-2024-41512

A SQL Injection vulnerability in "ccHandler.aspx" in all versions of CADClick v.1.11.0 and before allows remote attackers to execute arbitrary SQL commands via the "bomid" parameter...

Izanami 信任管理问题漏洞

Izanami is a shared configuration, feature flipping, and A/B testing server that is ideally suited for microservices architecture implementations. A security vulnerability exists in Izanami versions prior to 1.11.0 that stems from an attacker being able to bypass authentication in this applicatio...

Apache Allura Cross-Site Scripting Vulnerability

Apache Allura is the United States Apache Apache Software Foundation's set of open source project hosting platform. The platform supports the management of source code repositories, bug reports, wiki pages and blogs. A cross-site scripting vulnerability exists in the user drop-down selector in...