SecLens 情报中心

社区情报

来自安全社区、研究机构和开源生态的情报。

composer/guzzlehttp/guzzle: Guzzle: URI fragments disclosed in redirect Referer headers

发布时间 2026-07-21 07:28 (UTC+08:00) 抓取时间 2026-07-21 07:45 (UTC+08:00)

Severity: MEDIUM | CVSS: 5.9 | Package: composer/guzzlehttp/guzzle | Affected: < 7.15.1 | Patched: 7.15.1

扩展字段

{
  "credits": [
    {
      "login": "GrahamCampbell",
      "type": "reporter"
    }
  ],
  "cvss_score": 5.9,
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "cwe_ids": [
    "CWE-201",
    "CWE-212"
  ],
  "cwe_names": [
    "Insertion of Sensitive Information Into Sent Data",
    "Improper Removal of Sensitive Information Before Storage or Transfer"
  ],
  "ghsa_id": "GHSA-h95v-h523-3mw8",
  "package": {
    "ecosystem": "composer",
    "name": "guzzlehttp/guzzle",
    "patched_version": "7.15.1",
    "vulnerable_range": "< 7.15.1"
  },
  "references": [
    "https://github.com/guzzle/guzzle/security/advisories/GHSA-h95v-h523-3mw8",
    "https://github.com/guzzle/guzzle/pull/3901",
    "https://github.com/guzzle/guzzle/commit/7b68220d6543f6f80fe62e633361fc9d4ead14d4",
    "https://github.com/guzzle/guzzle/releases/tag/7.15.1",
    "https://github.com/advisories/GHSA-h95v-h523-3mw8"
  ],
  "source_code_location": "https://github.com/guzzle/guzzle",
  "updated_at": "2026-07-20T23:28:38Z"
}

GitHub Advisory ecosystem:composer severity:medium type:reviewed github_advisory official_bulletin package_vulnerability

composer/guzzlehttp/guzzle: Guzzle: Host-only cookie scope is not preserved

发布时间 2026-07-21 07:27 (UTC+08:00) 抓取时间 2026-07-21 07:45 (UTC+08:00)

Severity: MEDIUM | CVSS: 5.9 | Package: composer/guzzlehttp/guzzle | Affected: < 7.15.1 | Patched: 7.15.1

扩展字段

{
  "credits": [
    {
      "login": "GrahamCampbell",
      "type": "reporter"
    }
  ],
  "cvss_score": 5.9,
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "cwe_ids": [
    "CWE-201",
    "CWE-941"
  ],
  "cwe_names": [
    "Insertion of Sensitive Information Into Sent Data",
    "Incorrectly Specified Destination in a Communication Channel"
  ],
  "ghsa_id": "GHSA-wm3w-8rrp-j577",
  "package": {
    "ecosystem": "composer",
    "name": "guzzlehttp/guzzle",
    "patched_version": "7.15.1",
    "vulnerable_range": "< 7.15.1"
  },
  "references": [
    "https://github.com/guzzle/guzzle/security/advisories/GHSA-wm3w-8rrp-j577",
    "https://github.com/guzzle/guzzle/pull/3901",
    "https://github.com/guzzle/guzzle/commit/7b68220d6543f6f80fe62e633361fc9d4ead14d4",
    "https://github.com/guzzle/guzzle/releases/tag/7.15.1",
    "https://github.com/advisories/GHSA-wm3w-8rrp-j577"
  ],
  "source_code_location": "https://github.com/guzzle/guzzle",
  "updated_at": "2026-07-20T23:27:50Z"
}

GitHub Advisory ecosystem:composer severity:medium type:reviewed github_advisory official_bulletin package_vulnerability

composer/guzzlehttp/guzzle: Guzzle: Unbounded response cookies risk denial of service

发布时间 2026-07-21 07:27 (UTC+08:00) 抓取时间 2026-07-21 07:45 (UTC+08:00)

Severity: MEDIUM | CVSS: 5.3 | Package: composer/guzzlehttp/guzzle | Affected: < 7.15.1 | Patched: 7.15.1

扩展字段

{
  "credits": [
    {
      "login": "GrahamCampbell",
      "type": "reporter"
    }
  ],
  "cvss_score": 5.3,
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "cwe_ids": [
    "CWE-770",
    "CWE-1325"
  ],
  "cwe_names": [
    "Allocation of Resources Without Limits or Throttling",
    "Improperly Controlled Sequential Memory Allocation"
  ],
  "ghsa_id": "GHSA-f283-ghqc-fg79",
  "package": {
    "ecosystem": "composer",
    "name": "guzzlehttp/guzzle",
    "patched_version": "7.15.1",
    "vulnerable_range": "< 7.15.1"
  },
  "references": [
    "https://github.com/guzzle/guzzle/security/advisories/GHSA-f283-ghqc-fg79",
    "https://github.com/guzzle/guzzle/pull/3901",
    "https://github.com/guzzle/guzzle/commit/7b68220d6543f6f80fe62e633361fc9d4ead14d4",
    "https://github.com/guzzle/guzzle/releases/tag/7.15.1",
    "https://github.com/advisories/GHSA-f283-ghqc-fg79"
  ],
  "source_code_location": "https://github.com/guzzle/guzzle",
  "updated_at": "2026-07-20T23:27:03Z"
}

GitHub Advisory ecosystem:composer severity:medium type:reviewed github_advisory official_bulletin package_vulnerability

npm/astro: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

发布时间 2026-07-21 07:26 (UTC+08:00) 抓取时间 2026-07-21 07:45 (UTC+08:00)

Severity: MEDIUM | Package: npm/astro | Affected: >= 7.0.0, < 7.0.6 | Patched: 7.0.6

扩展字段

{
  "credits": [
    {
      "login": "jlgore",
      "type": "reporter"
    }
  ],
  "cwe_ids": [
    "CWE-352"
  ],
  "cwe_names": [
    "Cross-Site Request Forgery (CSRF)"
  ],
  "ghsa_id": "GHSA-8mv7-9c27-98vc",
  "package": {
    "ecosystem": "npm",
    "name": "astro",
    "patched_version": "7.0.6",
    "vulnerable_range": ">= 7.0.0, < 7.0.6"
  },
  "references": [
    "https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc",
    "https://github.com/withastro/astro/pull/17250",
    "https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a",
    "https://github.com/withastro/astro/releases/tag/[email protected]",
    "https://github.com/advisories/GHSA-8mv7-9c27-98vc"
  ],
  "source_code_location": "https://github.com/withastro/astro",
  "updated_at": "2026-07-20T23:26:28Z"
}

GitHub Advisory ecosystem:npm severity:medium type:reviewed github_advisory official_bulletin package_vulnerability

npm/@astrojs/netlify: @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

发布时间 2026-07-21 07:24 (UTC+08:00) 抓取时间 2026-07-21 07:45 (UTC+08:00)

Severity: LOW | CVSS: 3.7 | Package: npm/@astrojs/netlify | Affected: < 8.1.2 | Patched: 8.1.2

扩展字段

{
  "credits": [
    {
      "login": "sec-reex",
      "type": "reporter"
    }
  ],
  "cvss_score": 3.7,
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "cwe_ids": [
    "CWE-185"
  ],
  "cwe_names": [
    "Incorrect Regular Expression"
  ],
  "ghsa_id": "GHSA-hp3v-mfqw-h74c",
  "package": {
    "ecosystem": "npm",
    "name": "@astrojs/netlify",
    "patched_version": "8.1.2",
    "vulnerable_range": "< 8.1.2"
  },
  "references": [
    "https://github.com/withastro/astro/security/advisories/GHSA-hp3v-mfqw-h74c",
    "https://github.com/withastro/astro/pull/17018",
    "https://github.com/advisories/GHSA-529g-xq4f-cw38",
    "https://github.com/advisories/GHSA-hp3v-mfqw-h74c"
  ],
  "source_code_location": "https://github.com/withastro/astro",
  "updated_at": "2026-07-20T23:24:35Z"
}

GitHub Advisory ecosystem:npm severity:low type:reviewed github_advisory official_bulletin package_vulnerability

npm/body-parser: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

发布时间 2026-07-21 07:23 (UTC+08:00) 抓取时间 2026-07-21 07:45 (UTC+08:00)

扩展字段

{
  "credits": [
    {
      "login": "Phillip9587",
      "type": "reporter"
    },
    {
      "login": "efekrskl",
      "type": "remediation_reviewer"
    },
    {
      "login": "UlisesGascon",
      "type": "remediation_reviewer"
    },
    {
      "login": "bjohansebas",
      "type": "analyst"
    }
  ],
  "cve_id": "CVE-2026-12590",
  "cvss_score": 3.7,
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "cwe_ids": [
    "CWE-770"
  ],
  "cwe_names": [
    "Allocation of Resources Without Limits or Throttling"
  ],
  "ghsa_id": "GHSA-v422-hmwv-36x6",
  "package": {
    "ecosystem": "npm",
    "name": "body-parser",
    "patched_version": "1.20.6",
    "vulnerable_range": "< 1.20.6"
  },
  "references": [
    "https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-12590",
    "https://github.com/expressjs/body-parser/pull/698",
    "https://github.com/expressjs/body-parser/pull/741",
    "https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d",
    "https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac",
    "https://cna.openjsf.org/security-advisories.html",
    "https://github.com/expressjs/body-parser/releases/tag/1.20.6",
    "https://github.com/expressjs/body-parser/releases/tag/v2.3.0",
    "https://github.com/advisories/GHSA-v422-hmwv-36x6"
  ],
  "source_code_location": "https://github.com/expressjs/body-parser",
  "updated_at": "2026-07-20T23:23:28Z"
}

GitHub Advisory ecosystem:npm severity:low type:reviewed cve github_advisory official_bulletin package_vulnerability

npm/@astrojs/node: @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

发布时间 2026-07-21 07:22 (UTC+08:00) 抓取时间 2026-07-21 08:45 (UTC+08:00)

Severity: LOW | CVE: CVE-2026-59730 | Package: npm/@astrojs/node | Affected: >= 8.1.0, < 11.0.2 | Patched: 11.0.2

扩展字段

{
  "credits": [
    {
      "login": "alanturing881",
      "type": "reporter"
    }
  ],
  "cve_id": "CVE-2026-59730",
  "cwe_ids": [
    "CWE-601"
  ],
  "cwe_names": [
    "URL Redirection to Untrusted Site ('Open Redirect')"
  ],
  "ghsa_id": "GHSA-r557-wffq-wvrc",
  "package": {
    "ecosystem": "npm",
    "name": "@astrojs/node",
    "patched_version": "11.0.2",
    "vulnerable_range": ">= 8.1.0, < 11.0.2"
  },
  "references": [
    "https://github.com/withastro/astro/security/advisories/GHSA-r557-wffq-wvrc",
    "https://github.com/withastro/astro/pull/17252",
    "https://github.com/withastro/astro/commit/eb6f97e391ee587747e37609c255c7cd4b9cce3c",
    "https://github.com/withastro/astro/releases/tag/@astrojs/[email protected]",
    "https://github.com/advisories/GHSA-r557-wffq-wvrc"
  ],
  "source_code_location": "https://github.com/withastro/astro",
  "updated_at": "2026-07-20T23:22:22Z"
}

GitHub Advisory ecosystem:npm severity:low type:reviewed cve github_advisory official_bulletin package_vulnerability

npm/astro: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

发布时间 2026-07-21 07:21 (UTC+08:00) 抓取时间 2026-07-21 08:45 (UTC+08:00)

Severity: MEDIUM | CVE: CVE-2026-59729 | Package: npm/astro | Affected: < 7.0.6 | Patched: 7.0.6

扩展字段

{
  "credits": [
    {
      "login": "thientd",
      "type": "reporter"
    }
  ],
  "cve_id": "CVE-2026-59729",
  "cwe_ids": [
    "CWE-79"
  ],
  "cwe_names": [
    "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
  ],
  "ghsa_id": "GHSA-f48w-9m4c-m7f5",
  "package": {
    "ecosystem": "npm",
    "name": "astro",
    "patched_version": "7.0.6",
    "vulnerable_range": "< 7.0.6"
  },
  "references": [
    "https://github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5",
    "https://github.com/withastro/astro/pull/17251",
    "https://github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d",
    "https://github.com/withastro/astro/releases/tag/[email protected]",
    "https://github.com/advisories/GHSA-f48w-9m4c-m7f5"
  ],
  "source_code_location": "https://github.com/withastro/astro",
  "updated_at": "2026-07-20T23:22:00Z"
}

GitHub Advisory ecosystem:npm severity:medium type:reviewed cve github_advisory official_bulletin package_vulnerability

全部来源 Cloudflare 博客腾讯云安全公告 Adobe 安全公告阿里云 AVD Ubuntu 安全通告启明星辰安全通告 Amazon Linux AL2 公告 Amazon Linux AL2023 公告 AWS 安全公告 MSRC 更新指南 Oracle 安全警报 Apple 安全更新 Chrome 稳定版更新 Red Hat 安全公告 Atlassian 安全公告 NVIDIA 安全公告华为安全公告联想安全公告阿里云 Linux 安全公告阿里云 Linux CVE 通知阿里云安全公告 Amazon Linux 1 (EOL)安全公告 Amazon Linux 安全公告长亭漏洞库 Seebug 漏洞库 CISA KEV Catalog 微步银狐情报微步银狐 IOC Ransomware.live 近期受害者工信部 CNVDB CNNVD 通报 CNNVD 漏洞库 CNVD 漏洞库 TC260 标准征求意见 Seebug 技术 Paper GitHub Advisory HackerOne 博客 Exploit-DB 安天每日安全简讯 LinuxSecurity Hybrid VulDB 地方采购（CCGP）中央采购（CCGP） The Hacker News FreeBuf 社区 VIPRead 嘶吼安全资讯 Doonsec 微信聚合 arXiv cs.CR RSA Conference Podcast 新闻聚焦社区动态会议与培训融资快讯并购整合情报快报事件通报工具更新产品发布

社区情报

订阅来源 RSS