50781 matches found
CVE-2026-63107
creationtimestamp| type| source ---|---|--- 2026-07-20 23:09:54+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mr4g2l2kq52l 2026-07-20 23:09:55+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116954824349658240...
GHSA-WP74-JGXH-GV4Q Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET HTTP client System.Net.Http. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service...
GHSA-MWF2-3PR3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2. This affects applications that rely on maxBodyLength as a hard cap while forwarding attacker-controlled streams, such as upload endpoint...
Allocation of Resources Without Limits or Throttling
Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 stream handling of lib/adapters/http.js, which does not enforce maxBodyLength on streamed uploads becau...
Allocation of Resources Without Limits or Throttling
Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 stream handling of lib/adapters/http.js, which does not enforce maxBodyLength on stream...
EUVD-2026-41559
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header...
CVE-2026-47129
creationtimestamp| type| source ---|---|--- 2026-07-20 22:00:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4c7cpj5n2o 2026-07-20 22:02:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4cbe5sa32x...
CVE-2026-47198
creationtimestamp| type| source ---|---|--- 2026-07-20 22:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4c6mw66j22 2026-07-20 22:16:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4d2rwowl2e...
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
Summary Type: Uncontrolled recursion via mutual include. The Include directive checks for direct self-reference a.md cannot include a.md, but does not detect indirect cycles. Two markdown files that include each other a.md → includes b.md → includes a.md cause unbounded recursion until Python's...
CVE-2026-56452
Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...
EUVD-2026-41901
Pillow GdImageFile.open: image dimensions accepted without decompressionbombcheck...
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...
CVE-2026-56623 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows
Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...
CVE-2026-44230
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...
CVE-2026-61900
creationtimestamp| type| source ---|---|--- 2026-07-20 19:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr42ysop6c2q 2026-07-20 21:12:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr47j7mffc2x...
CVE-2026-61424
creationtimestamp| type| source ---|---|--- 2026-07-20 19:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr42vbmbff2u 2026-07-20 21:29:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4agkeocy2q 2026-07-30 22:00:03+00:00| seen|...
CVE-2026-60034
creationtimestamp| type| source ---|---|--- 2026-07-20 19:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr42va6iol2e 2026-07-20 20:51:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr46cid2y42g...
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...