The vulnerability of the TLS ECH traffic analyzer processor in Wireshark allows a hacker to induce a service failure.

The vulnerability of the TLS ECH traffic analyzer processor in Wireshark is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

Important: nginx

Issue Overview: An HTTP/2 denial of service vulnerability was found in nginx. Prior to the fix, there was no limit on the number of request headers a client could send. An attacker could seed the HPACK dynamic table with a header, then emit thousands of indexed references that each cost significa...

Vulnerability of the functions CliprdrStream_Read(), wf_cliprdr_server_file_contents_response(), and cliprdr_read_file_contents_response() in the RDP client FreeRDP, allowing a intruder to execute arbitrary code

The vulnerability of the CliprdrStreamRead, wfcliprdrserverfilecontentsresponse, and cliprdrreadfilecontentsresponse functions in the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

MCP setfunctypeversion Package Alias RCE via Unsanitized pnpm install + Dynamic Import Summary The setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string, interpolates it directly into an npm package specifier functype@, and installs it via pnpm add without any...

GHSA-WCJJ-9M6G-2FR2 functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

MCP setfunctypeversion Package Alias RCE via Unsanitized pnpm install + Dynamic Import Summary The setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string, interpolates it directly into an npm package specifier functype@, and installs it via pnpm add without any...

MAL-2026-16100 Malicious code in discord-mfa-solver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require ...

Security Bulletin: HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-68945 DESCRIPTION: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins...

Security Bulletin: the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-69151 DESCRIPTION: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline...

Security Bulletin: vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses.

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-54272 DESCRIPTION: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6...

Vulnerabilities in Adobe ColdFusion

Adobe has identified several vulnerabilities in Adobe ColdFusion. These vulnerabilities include a stored Cross-Site Scripting XSS vulnerability, where an attacker with low privileges can inject malicious scripts into form fields, which are then executed in the user’s browser. There is also a...

Security Advisory 0149

Security Advisory 0149 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73449 CVSSv3.1 Base Score: 5.9...

ROS-20260909-73-0172

The vulnerability in Chromium is related to overflow of the buffer in the dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Advanced Local Procedure Call (ALPC) handler in Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Advanced Local Procedure Call ALPC in Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...

CVE-2026-53933

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-53933

Maravel , a PHP dependency-injection framework, is vulnerable to side-channel information disclosure via dynamic route fuzzing in versions prior to 10.73.1 . When routes are compiled with dynamic placeholders (e.g., /api/v1/users/{id}), the raw placeholder key is mistakenly registered into the fl...

Malicious code in open-item-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from...

2026-09 Dynamic Cumulative Update for Windows 10 Version 21H2 for x86-based Systems (KB5122878)

2026-09 Dynamic Cumulative Update for Windows 10 Version 21H2 for x86-based Systems KB5122878...

Exploit for CVE-2026-73319

CVE-2026-73319 XenForo before 2.3.13 accepts a same-host jav...

CVE-2026-73319

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

EUVD-2026-72756

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...