CVE-2026-33490

H3 is a minimal HTTP framework. In versions 2.0.0-0 through 2.0.1-rc.16, the mount method in h3 uses a simple startsWith check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary i.e., that the next...

CVE-2026-33490

Summary (CVE-2026-33490) : In h3 versions 2.0.0-0 through 2.0.1-rc.16, the mount() implementation uses a startsWith() path-prefix check without validating a segment boundary, allowing middleware registered on a mounted sub-app (e.g., at /admin) to run for unrelated routes such as /admin-public or...

EUVD-2023-3247

Malicious code in bioql PyPI...

CVE-2024-48908

The CVE-2024-48908 entry relates to the lychee-action composite action, where the lychee-setup step in action.yml could enable arbitrary code injection prior to version 2.0.2. Affected component: lychee-action (via lychee-setup). Root cause: insecure handling in the setup of lychee within the com...