253025 matches found
mcpshield
mcpshield 一个针对未修补的 MCP STDIO 命令注入漏洞（CVE-2026-30623 系列，由 OX Security 于 2026 年 4 月披露，归为“设计问题”——无 SDK 补丁）的即插即用修复方案。只需导入一行代码，你的 Python 应用启动的每个 stdio MCP 服务器，在操作系统生成进程之前，其命令/参数/环境变量都会经过验证。 如果你是新手，请先阅读 适用范围，然后 安装 和 快速入门 将让你在两分钟内获得保护。 目录 项目状态 适用范围 安装 快速入门 选项 A：自动补丁（Python MCP 主机） 选项 B：静态检查（任何语言，零执行） 选项...
CLSA-2026-1788876191 TuxCare security update for org.springframework (8 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 8 CVEs. Fixed in 5.3.24-tuxcare.8...
HEIF Image Extensions Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally...
Windows DWM Core Library Elevation of Privilege Vulnerability
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges over a network...
Web Media Extensions Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network...
HEVC Video Extensions Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally...
RPC Runtime Library Remote Code Execution Vulnerability
Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network...
HEVC Video Extensions Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally...
CLSA-2026-1788871245 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.31-tuxcare.14...
ROOT-APP-GOBINARY-CVE-2026-43871 CVE-2026-43871 in github.com/apache/thrift - Patched by Root
Root has patched CVE-2026-43871 in the github.com/apache/thrift package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-41602 CVE-2026-41602 in github.com/apache/thrift - Patched by Root
Root has patched CVE-2026-41602 in the github.com/apache/thrift package for Root:Go. Multiple fixed versions available...
Important: Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...
CLSA-2026-1788869692 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.37-tuxcare.11...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
Important: Red Hat Security Advisory: ignition security update
An update for ignition is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
Important: Red Hat Security Advisory: ignition security update
An update for ignition is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2026-19203
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...
Important: Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...