net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-105846

The Payload headless content management system is vulnerable to an Open Redirect (CWE-601) in versions 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27 . An attacker can craft a malicious redirect URL parameter that sends a guest user to an untrusted destination immediately followi...

EUVD-2026-93488

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This...

NPM: i18next-http-backend incomplete URL validation permits SSRF

NPM: i18next-http-backend incomplete URL validation permits SSRF vulnerability discovered by ? in WordPress Npm i18next-http-backend versions 4.0.2...

GHSA-XVQ9-WJP8-HWQF i18next-http-backend incomplete URL validation permits SSRF

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolat...

DEBIAN-CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

EUVD-2026-93433

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

The i18next-http-backend library, used for loading translation resources in Node.js , browsers , and Deno , is vulnerable to Server-Side Request Forgery (SSRF) and URL injection prior to version 4.0.2 . The root cause is incomplete URL validation where attacker-controlled language or namespace va...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CLSA-2026-1789464832 git-lfs: Fix of 5 CVEs

rebuild with golang 1.25.7-1.el96.tuxcare.els16 to fix Go standard library CVEs - CVE-2026-33818: enforce a maximum recursion depth in encoding/asn1 Unmarshal to prevent stack exhaustion when parsing deeply-nested recursive structures - CVE-2026-56860: avoid quadratic complexity in net/url...

CLSA-2026-1791279538 delve: Fix of 5 CVEs

Rebuild with golang 1.25.7-1.el96.tuxcare.els16 to fix the following CVEs - CVE-2026-33818: enforce a maximum recursion depth in encoding/asn1 Unmarshal to prevent stack exhaustion on deeply nested structures - CVE-2026-56859: add a recursion depth guard in encoding/xml so that DecodeElement no...

github.com/getkin/kin-openapi: kin-openapi: Authentication bypass via URL path decoding discrepancy

A flaw was found in kin-openapi. An unauthenticated remote attacker can bypass authentication checks on protected routes by sending requests containing encoded path separators. This issue occurs because the request validation handler inspects the decoded URL path, while certain downstream routers...

Multiple vulnerabilities in Android application "Ticket Ryutsu Center"

Overview Android application "Ticket Ryutsu Center" provided by Wavedash Co., Ltd. contains multiple vulnerabilities listed below: Use of Hard-coded Credentials CWE-798 - CVE-2026-92861 Improper Authorization in Handler for Custom URL Scheme CWE-939 - CVE-2026-92862 Koki Sato of BroadBand Securit...

onedrive_user_enum

onedriveuserenum v2.10 Gültige OneDrive-Benutzer enumerieren Eine vollständige Erläuterung der Enumerationstechnik und der OneDrive-Enumeration finden Sie im Blog hier: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ Wenn Sie nach der alten Version ohne Datenbank der OneDrive-Enumerati...

CLEANSTART-2026-DH14395 net/url package does not set a limit on the number of query parameters in a query

Security vulnerability affects the go1.27 package. The net/url package does not set a limit on the number of query parameters in a query...