libfuse 资源管理错误漏洞

libfuse is an open-source user-space file system development library developed by libfuse. Versions of libfuse 3.18.0 to 3.18.2 contained a resource management vulnerability. This vulnerability stemmed from issues with the iouring subsystem, where objects were reclaimed and then reused, potential...

Uptime Kuma 安全漏洞

Uptime Kuma is an easy-to-use, self-hosted monitoring tool developed by Louis Lam. Versions of Uptime Kuma from 1.23.0 to 2.2.0 contain security vulnerabilities. These vulnerabilities stem from incomplete protection against server-side template injections, which could allow unauthorized access to...

fast-xml-parser 安全漏洞

fast-xml-parser is an open-source library developed by Natural Intelligence. It is used for quickly validating, parsing, and processing XML files without relying on C/C++-based libraries or callbacks. There are security vulnerabilities in the versions of fast-xml-parser from 4.0.0-beta.3 to 5.5.5...

CVE-2026-32019 OpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guard

OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4 function, allowing requests to RFC-reserved ranges to bypass SSRF policy checks. Attackers with network reachability to special-use IPv4 ranges can exploit webfetch functionality to acce...

42towels (>=0.1.1001 <=0.1.1011), aait (>=0.0.4.80 <=2.3.14) +289 more potentially affected by CVE-2026-3029 via pymupdf (>=1.16.14 <=1.26.6)

pymupdf PYPI version =1.16.14, =0.1.1001, =0.0.4.80, =0.1.3, =0.7.0, =0.0.1, =0.1.31, =0.0.5, =0.0.3.20, =0.0.1, =0.1.0, =1.5.0, =1.2.3, =1.4.11 - arcoocr =1.0.1 and more Source cves: CVE-2026-3029 Source advisory: SNYK:PYTHON-PYMUPDF-15702040...

NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

Summary NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and...

acherion (>=0.2.0 <=0.9.2), aesp (=2025.9.12) +207 more potentially affected by CVE-2026-33332 via nicegui (>=3.0.4 <=3.8.0)

nicegui PYPI version =3.0.4, =0.2.0, =1.0.0, =0.4.0, =0.1.0, =0.2.0, =0.3.0, =0.0.0, =0.4.14, =1.0.0, =0.1.0, =1.2.2 - bellatrex =0.4.0 and more Source cves: CVE-2026-33332 Source advisory: SNYK:PYTHON-NICEGUI-15701842...

CVE-2025-71259

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of...

CVE-2025-71259

BMC FootPrints ITSM versions 20.20.02–20.24.01.001 expose a Server-Side Request Forgery (SSRF) in the /footprints/servicedesk/externalfeed/RSS endpoint via the feedUrl parameter. The flaw allows unauthenticated attackers to induce the server to make outbound requests to arbitrary URLs, potentiall...

01os (=0.0.14), aa-rag (>=0.4.2 <=0.4.3) +928 more potentially affected by CVE-2026-33231 via nltk (>=2.0.4 <=3.9.3)

nltk PYPI version =2.0.4, =0.4.2, =0.2.3, =0.2.0, =0.0.4, =0.0.1, =0.1.0, =0.1.0, =0.0.9, =0.1.0 and more Source cves: CVE-2026-33231 Source advisory: OSV:GHSA-JM6W-M3J8-898G...

CVE-2026-25312

Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through = 4.2.8.3...

fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata

...

abadpour (>=6.13.1 <=7.24.1), abcli (>=9.273.1 <=9.572.1) +766 more potentially affected by CVE-2025-15031 via mlflow-skinny (>=3.0.0 <=3.9.0)

mlflow-skinny PYPI version =3.0.0, =6.13.1, =9.273.1, =2.0.0, =0.1.0, =0.1.0, =0.4.4, =0.3.0, =0.1.0, =1.0.0, =1.1.0, =0.1.0, =1.0.0, =1.0.1 and more Source cves: CVE-2025-15031 Source advisory: SNYK:PYTHON-MLFLOWSKINNY-16698159...

SUSE CVE-2025-71268

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reservation leak in some error paths when inserting inline extent If we fail to allocate a path or join a transaction, we return from cowfilerangeinline without freeing the reserved qgroup data, resulting in a leak. Fi...

SUSE CVE-2026-23248

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perfmmap Syzkaller reported a refcountt: addition on 0; use-after-free warning in perfmmap. The issue is caused by a race condition between a failing mmap setup and a concurrent mm...

OpenClaw 代码问题漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.2.22 had code vulnerabilities. These vulnerabilities stemmed from the incomplete validation of the IPv4 special-purpose range by the isPrivateIpv4 function, which could allow...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the DecryptBytes function. An attacker can cause the process or goroutine to crash by sending a crafted AES-CBC encrypted assertion with a plaintext of all zero bytes, which triggers a panic due to...

affo-deeplink (=1.0.1), ai-ebash (>=0.2.17 <=0.2.25) +78 more potentially affected by CVE-2026-33154 via dynaconf (>=0.5.4 <=3.2.12)

dynaconf PYPI version =0.5.4, =0.2.17, =7.0.4, =0.1.0, =0.7.0, =4.1.0, =0.1.0, =0.4.2, =1.8.1, =0.4.2, =0.1.3, =0.1.1, =0.1.83, =0.1.90 and more Source cves: CVE-2026-33154 Source advisory: OSV:GHSA-PXRR-HQ57-Q35P...

Filament Unvalidated Range and Values summarizer values can be used for XSS

Two Table summarizers Range, Values render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with...

GHSA-VV3X-J2X5-36JC Filament Unvalidated Range and Values summarizer values can be used for XSS

Two Table summarizers Range, Values render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with...