EUVD-2026-88758

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

CVE-2026-7192

The Dbit T-CPE301K 4G Mini WiFi Router is susceptible to a stack-based buffer overflow vulnerability. An authenticated attacker can trigger a denial of service (DoS) and a system reboot by sending a manipulated HTTP POST request to the /js/common/do_cmd.js endpoint. The vulnerability is caused by...

CVE-2026-7192 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

CVE-2026-7192 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

ROOT-APP-NPM-CVE-2026-48068 CVE-2026-48068 in @grpc/grpc-js - Patched by Root

Root has patched CVE-2026-48068 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available...

CVE-2026-101916

A flaw was found in grpc-js. In configurations where client certificates are optional, the authentication context lookup fails to distinguish between authorized and unauthorized peer certificates. A remote attacker can exploit this vulnerability by presenting an untrusted certificate, allowing th...

CLEANSTART-2026-RI71860 js-yaml is a JavaScript YAML parser and dumper

Security vulnerability affects the argo-workflows package. js-yaml is a JavaScript YAML parser and dumper...

weakrng-sweep

weak-rng スイープ（CVE-2026-71851 クラス） 調査ツール：PRNG スキーム × uint32 シードを列挙し、BIP39 ウォレットを導出し、 被害者アドレス集合に対するメンバーシップをチェックします（防御的調査、illbloom スタイル）。 スキーム：0-10（illbloom：MT19937/glibc/Java/LCG/xorshift）、11-13（glibc-31 LCG）、 14-15（crypto-js 3.3.0 WordArray.random MWC 移植版、node とのバイト検証済み）。 実行方法：Actions - mwc-sweep ...

CVE-2025-44998

CVE-2025-44998 概要 TinyFileManager v2.4.7 のコンポーネント /tinyfilemanager.php における保存型クロスサイトスクリプティング（XSS）の脆弱性により、攻撃者は js-theme-3 パラメータに細工したペイロードを注入することで、任意の JavaScript または HTML を実行することができます。 PoC 脆弱性を確認するには、設定ページ（URL: http://localhost/index.php?p=&settings=1）にアクセスします。 リクエストを送信する際に、js-theme-3...

Partial String Comparison

Overview @grpc/grpc-js-xds is a Plugin for @grpc/grpc-js. Adds the xds:// URL scheme and associated features. Affected versions of this package are vulnerable to Partial String Comparison via the PathExactValueMatcher.apply method in matcher.ts, where the case-insensitive exact path match...

Server-generated Error Message Containing Sensitive Information

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Server-generated Error Message Containing Sensitive Information via the server-side RPC error handler in server.ts, which unconditionally includes the raw exception message in the gRPC status...

Improper Certificate Validation

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Improper Certificate Validation via getAuthContext in server-interceptors.ts and the TLS session handling in transport.ts, where the authorized property of a TLS socket is not checked before...

AZL-105075 CVE-2026-102276 affecting package js-jquery 3.5.0-4

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and use...

CVE-2026-101916

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101915

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

CVE-2026-101914

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path method name matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service...

CVE-2026-101916 @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101916 @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101916 @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101916

The @grpc/grpc-js library (versions prior to 1.13.6 and 1.14.5 ) contains a vulnerability where the getAuthContext function fails to distinguish between authorized and unauthorized peer certificates. This occurs specifically when server credentials have requireClientCertificate set to false . If ...