CVE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-56846: Uncontrolled Resource Consumption

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-56848: Use After Free

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

Oracle Linux 10 : nodejs-nodemon (ELSA-2026-48032)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-48032 advisory. 3.1.14-2 - Regenerete sources. 3.1.14-1 - Update to version 3.1.14 3.0.3-7 - revert of ce0df1a 3.0.3-6 - deps: revert letting nodemon work with any node Tenab...

PT-2026-67694

Name of the Vulnerable Software and Affected Versions oidcc plug versions 0.2.0-beta.1 through 0.4.9 Description A Cross-Site Request Forgery issue in the Oidcc.Plug.AuthorizationCallback module allows an attacker to force a victim's browser to complete an unauthorized authorization flow. The...

Amazon Linux 2 : java-17-amazon-corretto, --advisory ALAS2-2026-3842 (ALAS-2026-3842)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.20+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3842 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

PT-2026-74328

TuxCare rebuilt 17 @angular packages to address 2 CVEs. Fixed in 16.2.12-tuxcare.2...

Amazon Linux 2 : libxml2, --advisory ALAS2-2026-3827 (ALAS-2026-3827)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3827 advisory. libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershel...

PT-2026-75297

TuxCare rebuilt 17 @angular packages to address 2 CVEs. Fixed in 13.3.11-tuxcare.2...

3xhaustpi (>=0.1.3, <=0.2.1), @0x0.bug/pi-coding-agent (1.0.0) +1079 more potentially affected by CVE-2026-15157 via undici (>=8.0.0, <=8.8.0)

undici NPM version =8.0.0, =0.1.3, =0.1.8, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =0.5.1 and more Source cves: CVE-2026-15157 Source...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

UBUNTU-CVE-2026-12802

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

EUVD-2026-52029

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

kani-tts (1.0.1), kani-tts-2 (>=0.0.1, <=0.0.5) +3 more potentially affected by CVE-2026-9856 via transformers (4.52.0)

transformers PYPI version 4.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - kani-tts 1.0.1 - kani-tts-2 =0.0.1, =0.10.0.dev5, =0.10.0.dev6 - mmore 1.0.0 - naijalingo-tts 0.0.2 Source cves: CVE-2026-9856 Source...

Malicious Package

Overview simple-date-formatter-util-2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-11485 Malicious code in simple-date-formatter-util-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...

DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 6.2.0, 6.3.0, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

Duplicate Advisory: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mwf2-3pr3-8698. This link is maintained to preserve external references. Original Description axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request...