VulnScope — 以套件為主體的 CVE 查詢工具- MEDIUM5.3CVE-2026-48988markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
- MEDIUM5.3OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
- MEDIUM5.3Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
- MEDIUM5.3UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
- MEDIUM5.3protobufjs: Memory amplification from preserved unknown fields in binary decode
- CRITICAL9.8Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
- MEDIUM6.1DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
- MEDIUM6.1DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
- MEDIUM5.3protobufjs : Schema-derived names can shadow runtime-significant properties
- MEDIUM5.3JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
- MEDIUM5.4Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
- CRITICAL9.0Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
- MEDIUM6.5Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
- MEDIUM6.7LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
- MEDIUM6.9Vim is an open source, command line text editor.
- MEDIUM5.8Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
- MEDIUM5.3@hapi/inert has a static-file confinement bypass via sibling-prefix path
- MEDIUM6.5python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
- CRITICAL9.1Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
- MEDIUM5.3joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
- MEDIUM6.5@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
- MEDIUM5.9Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
- MEDIUM6.5vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors
- CRITICAL9.8Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.
- MEDIUM4.8Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authent…