24399 matches found
PT-2026-60457
Name of the Vulnerable Software and Affected Versions stoatchat delta versions prior to 20250210-1 0.8.2 Description A logic error exists in the query messages route. When fetching messages nearby another message, the database query can be assigned a message limit of zero, which the database...
CVE-2026-56456: Exposure of Sensitive Information to an Unauthorized Actor
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...
CVE-2026-52887
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filterlatestMsgReceiveTimestamp$lt value was inserted into a...
CVE-2026-52869
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamablehttpmanager.StreamableHTTPSessionManager route requests to existing...
CVE-2026-52869 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamablehttpmanager.StreamableHTTPSessionManager route requests to existing...
Allocation of Resources Without Limits or Throttling
Overview ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the receiver.js. An attacker can cause memory exhaustion by sending incomplete fragmented WebSocket...
CVE-2026-62389
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779...
Protobuf: Unbounded recursion depth in embedded-message decoding
Summary Unbounded recursion depth in Protobuf.Decoder Hex package protobuf, versions = 0.8.0, 0.16.1 lets an unauthenticated attacker crash any service that decodes untrusted protobuf messages whose schema contains a self-referential or cyclic message type. A small request body a few KB to a few ...
GHSA-RV48-QQJ5-CRXG Protobuf: Unbounded recursion depth in embedded-message decoding
Summary Unbounded recursion depth in Protobuf.Decoder Hex package protobuf, versions = 0.8.0, 0.16.1 lets an unauthenticated attacker crash any service that decodes untrusted protobuf messages whose schema contains a self-referential or cyclic message type. A small request body a few KB to a few ...
MGASA-2026-0253 Updated openssl packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion. CVE-2026-7383 Out-of-Bounds Read in CMS Password-Based Decryption. CVE-2026-9076 Heap Buffer Over-read in ASN.1 Content Parsing. CVE-2026-34180 PKCS12 Files with PBMAC1 Are...
CVE-2026-62389
CVE-2026-62389 affects the ws library (before 8.21.1). The root cause is a memory exhaustion condition in lib/receiver.js where the fragment guard only triggers at maxFragments, allowing an attacker to exhaust heap memory by sending incomplete fragmented WebSocket messages (text frame FIN=0 plus ...
CVE-2026-62389 ws < 8.21.1 Default maxFragments Allows Memory Exhaustion DoS
ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers when fragment count reaches maxFragments, allowing attackers to exhaust memory by sending incomplete fragmented WebSocket messages. Attackers can send a text frame with FIN=0...
CVE-2026-62389
Removed by vendor...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...