261990 matches found
GHSA-XV26-6W52-CPH6 websocket-driver: Message corruption via abuse of protocol length headers
Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server pars...
CVE-2026-55398
creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:21+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptm4mdb2w...
js-yaml: js-yaml: Denial of Service via crafted YAML documents
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...
ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments
A flaw was found in Net::IMAP, a Ruby library that provides Internet Message Access Protocol IMAP client functionality. This vulnerability allows a remote attacker to inject arbitrary IMAP commands. This is achieved by passing specially crafted symbol arguments to IMAP commands. Successful...
CVE-2026-49988
creationtimestamp| type| source ---|---|--- 2026-07-15 21:30:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpo5tfq562s...
CVE-2026-62947
creationtimestamp| type| source ---|---|--- 2026-07-15 21:25:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpnuuez3f2s 2026-07-19 00:01:59+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqxhztoy432e...
CVE-2026-48261
creationtimestamp| type| source ---|---|--- 2026-07-15 21:18:14+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqpnic5jpt2z...
CVE-2026-62314 Anubis: Policy bypass via client controlled X-Original-URI header
Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP...
CVE-2026-15921 nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory
Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, nvm ls-remote and other commands that refresh remote LTS aliases, such as nvm install --lts parse the node.js mirror's index.tab and use each release's LTS...
CVE-2026-53444
Wekan (open-source Kanban, Meteor-based) prior to v9.32 had missing authorization on OIDC-related Meteor methods (e.g., setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, boardRoutineOnLogin, groupRoutineOnLogin) in packages/wekan-oidc/oidc_server.js a...
CVE-2026-55576
The CVE-2026-55576 entry concerns MaaAssistantArknights. In the dev-v2 workflow, the string from github.event.pull_request.title was inlined into a run: shell command in .github/workflows/release-preparation.yml for PRs opened, reopened, or ready_for_review. A non-draft fork PR with a title start...
CVE-2026-40952
creationtimestamp| type| source ---|---|--- 2026-07-15 21:00:14+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpmi4bypn2i...
CVE-2026-12997
creationtimestamp| type| source ---|---|--- 2026-07-15 20:57:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpmceqwmg2m 2026-07-16 06:01:01+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqqkp3t52c2u...
CVE-2026-56679
9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole...
CVE-2026-55608
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLEMULTITENANT=true could allow an authenticated tenant to access default-scope workflowversions backups instead of being confined to...
CVE-2026-55608 n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLEMULTITENANT=true could allow an authenticated tenant to access default-scope workflowversions backups instead of being confined to...
GHSA-39PV-4J6C-2G6V vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-PRJF-86W9-MFQV vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
