postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service

A malicious or compromised server can return a binary hstore value with an invalid internal length field, causing the client to panic while decoding it. Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied...

GHSA-RGQC-3X5P-6GWG postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service

A malicious or compromised server can return a binary hstore value with an invalid internal length field, causing the client to panic while decoding it. Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied...

Acelle-Mail-4.0.24-Unauthenticated-Path-Traversal-to-RCE-Chain

Acelle Mail Note: The path traversal alone Step 1 is su...

Double Decoding of the Same Data

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in normalize and resolve and the authority recomposition logic in index.js and lib/utils.js. An attacker can redirect an...

Double Decoding of the Same Data

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in normalize and resolve and the authority recomposition logic in index.js and lib/utils.js. An attacker...

Panic on Decoding Short Hybrid Keys

The deserialization functions X25519MlKem768Draft00PrivateKey::decode X25519MlKem768Draft00PublicKey::decode and XWingKemDraft06PublicKey::decode would panic during an indexing operation when provided an input slice that is shorter than the length of the given key type, i.e. shorter than 2400 byt...

Astra Linux – Vulnerability in Linux 5.15, Linux

In the Linux kernel, the following vulnerability has been resolved: NFSD: prevented underflow in nfssvcdecodewriteargs Smatch reported the issue as follows: fs/nfsd/nfsxdr.c:341 nfssvcDecodeWriteArgs Warning: no lower bound on ‘args-len’ The type of the variable has been changed to unsigned to...

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-76172

fast-uri , a URI parser for Node.js, is vulnerable to host confusion via percent-encoded scheme normalization . The root cause is a legacy decoding pass applied to the scheme component that is never re-escaped before serialization, causing a mismatch between the parsed host (undefined) and the re...

CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899

fast-uri , a URI parser for Node.js, suffers from double percent-decoding of the hostname: it decodes percent escapes during parsing and decodes them again during authority recomposition. This violates RFC 3986 §2.4 (an implementation must not decode the same string more than once) and allows a s...

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...

PT-2026-81170

Name of the Vulnerable Software and Affected Versions tagDiv Composer versions prior to 5.4.6 Description The plugin contains a Stored Cross-Site Scripting issue within the vc raw html shortcode. The vc raw html::render function fails to properly sanitize input and escape output by base64-decodin...

PT-2026-80191

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.4.1 through 2.4.4 fast-uri versions 3.1.2 through 3.1.5 fast-uri versions 4.0.0 through 4.1.2 Description This URI parser for Node.js decodes percent escapes in a hostname during parsing and subsequently decodes the parsed...

CVE-2026-75899: Double Decoding of the Same Data

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

The vulnerability of the HEIF and AVIF file encoding/decoding library lies in its ability to trigger service interruptions when reading data beyond the permissible buffer size.

The vulnerability of the HEIF and AVIF file encoding/decoding library lies in reading data from buffers beyond their acceptable limits. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...