13173 matches found
PT-2026-120266
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.0.1-tuxcare.2...
PT-2026-109656
Name of the Vulnerable Software and Affected Versions SillyTavern versions 1.12.13 through 1.19.0 Description A denial of service issue exists where unauthenticated remote attackers can exhaust system memory and CPU resources. This occurs because the body-parser middleware processes incoming...
PT-2026-120258
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 1.12.0-tuxcare.2...
PT-2026-120264
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.7.3-tuxcare.2...
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings e.g. curl -X "M1"...
GHSA-6R69-C6WG-7G8M yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings e.g. curl -X "M1"...
CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...
CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...
CVE-2026-107840
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...
CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...
EUVD-2026-95935
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...
CVE-2026-107840
The yopass secret-sharing service is vulnerable to a memory exhaustion attack in versions prior to 14.7.0 . The root cause lies in the Prometheus metrics middleware within pkg/server/server.go, which uses the attacker-controlled r.Method value as a label for yopass_http_requests_total and yopass_...
PT-2026-108963
Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Nginx UI contains a cross-site request forgery CSRF flaw where the AuthRequired middleware accepts a browser-managed cookie named token as a valid API credential. Because management endpoints d...
Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System
Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-48714 DESCRIPTION: i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, th...
ghost-as-middleware (1.0.0), ghost-blade (0.1.0) +3 more potentially affected by CVE-2026-104412 +1 more via ghost (>=0.5.10, <=1.26.2)
ghost NPM version =0.5.10, =0.1.7, =0.1.10 - persistent-ghost 0.8.2 - sign-alex 1.0.1 Source cves: CVE-2026-104412, CVE-2026-105678 Source advisory: SNYK:JS-GHOST-21693955...
ghost-as-middleware (1.0.0), ghost-blade (0.1.0) +3 more potentially affected by CVE-2026-104412 +1 more via ghost (>=0.5.10, <=1.26.2)
ghost NPM version =0.5.10, =0.1.7, =0.1.10 - persistent-ghost 0.8.2 - sign-alex 1.0.1 Source cves: CVE-2026-104412, CVE-2026-105678 Source advisory: OSV:GHSA-4PVX-FWJJ-8GPC...
CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under...
ROOT-APP-NPM-GHSA-P3F5-W63M-MXPH GHSA-p3f5-w63m-mxph in webpack-dev-middleware - Patched by Root
Root has patched GHSA-p3f5-w63m-mxph in the webpack-dev-middleware package for Root:npm. Multiple fixed versions available...