CVE-2026-71848

Summary: CVE-2026-71848 affects the Hono web framework (4.12.0–4.12.33) via the languageDetector middleware. The root cause is an implementation in normalizeLanguage() that builds language tag prefixes with parts.slice(0, i).join('-') for every possible prefix, causing the total string processing...

CVE-2026-71848 Hono: Algorithmic Complexity DoS in Language Middleware

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To...

CVE-2026-71848 Hono: Algorithmic Complexity DoS in Language Middleware

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To...

CVE-2026-71848 Hono: Algorithmic Complexity DoS in Language Middleware

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To...

SUSE CVE-2026-70633

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-19211

The CVE-2026-19211 entry applies to SourceCodester Photo Share Website 1.0. Affected component: the signup path, specifically /social/ajax.php?action=signup. Vulnerability: SQL injection triggered by manipulating the email argument, enabling remote exploitation. Public exploit exists. Impact indi...

EUVD-2026-54523

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made publ...

CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

CVE-2026-17595

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

gitgalaxy — Updated!

GitGalaxy Docs · Visualizer 1 scan · 97 structural signals · 50+ languages · 0 need for compilation 19 risk exposure scores · 6 final reports · 0 dependencies · pip install gitgalaxy What Pain Point Does This Solve? GitGalaxy exists for one recurring problem: understanding a large, real,...

Security Bulletin:Vulnerability in grub affects IBM Netezza Appliance

Summary The grub package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2024-45777 Vulnerability Details CVEID:CVE-2024-45777 DESCRIPTION: A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in...

Security Bulletin:i18nextify JavaScript Library: URL-Injection Vulnerability Prior to 3.0.5

Summary i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template...

CVE-2026-71559 Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users o...

XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization

...

Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path

...

OESA-2026-3308 librabbitmq security update

This is a C-language AMQP client library for use with AMQP servers speaking protocol versions 0-9-1. Security Fixes: CVE-2026-59986 is a security vulnerability affecting the librabbitmq library. Specific details of the vulnerability have not been disclosed. librabbitmq is the C client library for...

[SECURITY] Fedora 43 Update: php-8.4.24-1.fc43

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

EUVD-2026-54182

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator tsl/src/compression/algorithms/dictionary.c. The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds,...

EUVD-2026-54114

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...