EUVD-2026-58510

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

EUVD-2026-58512

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

EUVD-2026-58466

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps...

EUVD-2026-58462

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking...

EUVD-2026-58403

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read...

EUVD-2026-58388

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...

EUVD-2026-58372

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read...

EUVD-2026-58369

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...

EUVD-2026-58235

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop...

EUVD-2026-58194

TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in...

EUVD-2026-58127

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

EUVD-2026-58126

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

EUVD-2026-58124

Webhook Authorization Header Returned in Plaintext via API...

EUVD-2026-58173

Private Repository Existence Disclosure via go-get Meta Endpoint...

EUVD-2026-58171

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

EUVD-2026-58172

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

EUVD-2026-58169

Repository migration SSRF via multi-answer DNS allow-list bypass...

EUVD-2026-58170

Public-only repository tokens can update private PR head branches...

EUVD-2026-58167

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

EUVD-2026-58165

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...