30385 matches found
CVE-2026-61629 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware
nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...
PT-2026-96109
Name of the Vulnerable Software and Affected Versions nginx ignition versions 2.29.0 through 2.40.0 Description The API server in nginx ignition contains a flaw in its i18nMiddleware function that processes the Accept-Language header. The middleware calls...
ROS-20260921-73-0113
The vulnerability of the Close function in the Go programming language is related to the operation of writing data outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures...
SSP-Bench: A Hybrid Data Generation Framework for Safety, Security, and Privacy Evaluation
Evaluation of large language models LLMs for safety, security, and privacy SSP relies heavily on static benchmarks, which suffer from score saturation, data contamination, and aggregation artifacts, and fail to capture sensitivity to linguistic variation. As a result, models that perform well on...
CVE-2026-61629: Allocation of Resources Without Limits or Throttling
nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...
yakit v1.4.8-0919
YAKIT-A Cyber Security ALL-IN-ONE Platform based on Yak language Whitepaper β’ Official documentation β’ Issue feedback β’ Official website β’ Community β’ Architecture :book:LanguageοΌ English β’ δΈζ Introduction Security integration is a reform of security operations and management for enterprises in t...
GHSA-3RM2-H79C-8QW6 md-editor-v3: XSS via fenced-code language rendering bypass
Summary MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled. Details useMarkdownIt packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206 registers a...
CVE-2026-84992
md-editor-v3 , a Markdown editor for Vue 3, contains an XSS vulnerability in MdPreview's useMarkdownIt() highlight callback (useMarkdownIt.ts:206). The fenced-code language value is interpolated into class="language-${language}" and an unquoted language=${language} HTML attribute without escaping...
CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...
CLEANSTART-2026-WP38878 gRPC-Go is the Go language implementation of gRPC
Multiple security vulnerabilities affect the cloudnative-pg-fips package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-XH08905 gRPC-Go is the Go language implementation of gRPC
Multiple security vulnerabilities affect the cloudnative-pg package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
Malicious Package
Overview language-selector-content is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
A Bootiful Podcast: Spring Tools lead Martin Lippert
Hi, Spring fans! In this conversation, Spring Tools lead Martin Lippert joins us for a fascinating look at how developer tooling has evolved from Eclipse to VS Code and beyond. We dig into the architecture behind Spring Tools, language servers, MCP, and how the same ideas that once helped...
bithoven v0.1.0
Bithoven πΌ A High-Level, Imperative Language for Bitcoin Smart Contracts Bithoven is a type-safe, developer-friendly programming language designed to compile down to native Bitcoin Script. It bridges the gap between complex smart contract logic and the low-level stack machine of the Bitcoin Virtu...
[SECURITY] Fedora 43 Update: erlang-26.2.5.21-7.fc43
Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson...
[SECURITY] Fedora 44 Update: ruby-4.0.6-38.fc44
Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...
[SECURITY] Fedora 45 Update: ruby-4.0.6-38.fc45
Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38430)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the setLanguageCfg function. Attackers can exploit this vulnerability by sending a specially crafted POS...
CVE-2026-18422
Concrete CMS before 9.5.3 is vulnerable in the multilingual page assignment backend action (Backend\Page\Multilingual::assign), where a destination-side authorization check and a CSRF token validation were both missing. An authenticated user holding only the Edit Page Multilingual Settings permis...
CVE-2026-18422 Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation
Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...