CVE-2026-19118

A time-of-check time-of-use (TOCTOU) race condition in GitHub Enterprise Server enabled remote code execution . Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests . All versions prior to 3.22 were affected; fixes are avai...

CVE-2026-19118 Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

GHSA-R3J6-GPJW-QFJR Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code...

Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code...

CVE-2026-84365

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...

CVE-2026-49329 Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

CVE-2026-49329 Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

CVE-2026-83614 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

CVE-2026-83614

xmldom , a pure JavaScript XML DOM parser, is vulnerable to quadratic-time denial of service via two independent code paths. The first, in lib/sax.js, causes parseElementStartPart to repeatedly rescan a malformed tag name to the next > during single-character recovery, reachable through the de...

CVE-2026-83614 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

CVE-2026-83613

xmldom , a pure JavaScript W3C XML DOM parser, is affected by a quadratic-time complexity flaw in DOMHandler.startElement (lib/dom-parser.js). Each parsed attribute is inserted via setAttributeNode, which triggers a linear getNamedItem/getNamedItemNS lookup in NamedNodeMap.setNamedItem (lib/dom.j...

CVE-2026-83613 xmldom: Quadratic-time attribute deduplication

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode...

CVE-2026-83613 xmldom: Quadratic-time attribute deduplication

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode...

CVE-2026-83613 xmldom: Quadratic-time attribute deduplication

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode...

継続的脆弱性評価の導入：AI脅威時代に向けたリアルタイム防御

Wiz CVA を使用して、新しい脆弱性が公開された瞬間にその露出を検出します...

AKRASIA: Stealthy Backdoor Attack on Reasoning-Based Code LLMs

We present AKRASIA, a stealthy, inference-time backdoor attack against reasoning-based Code LLMs. AKRASIA aims to achieve a backdoor target e.g., malicious code execution in reasoning LLMs while evading automated defenses and human inspection. To achieve this, AKRASIA probes the victim LLM to...

PT-2026-84296

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

JENGA: Exploiting Counter-Based RowHammer Countermeasures to Break Real-Time Predictability

Safety-critical real-time systems must satisfy multiple dependability requirements, notably time predictability and security. In such systems, tasks must complete within bounded and known execution times, typically characterised through Worst-Case Execution Time WCET analysis. At the same time,...

CVE-2026-82398

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82398 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...