CVE-2026-68901

In Wekan versions before 10.38, export endpoints in models/export.js and models/exportExcel.js called user._id.toString() without null-checking ReactiveCache.getUser(), throwing a TypeError on an invalid authToken and crashing the process via unhandled rejection. Fixed in 10.38 with a 401 guard a...

MINI-J86M-HVPX-HVW6

Bulletin has no description...

MINI-6R63-R9H7-9X5M

Bulletin has no description...

PT-2026-78324

Name of the Vulnerable Software and Affected Versions mod cluster affected versions not specified Description A flaw exists in the AdvertiseListenerImpl of the org.jboss.modcluster core module. An unauthenticated attacker can cause a denial of service by sending a single crafted UDP multicast...

MINI-XQ3C-MXR9-2HPF

Bulletin has no description...

MINI-44P3-8QVP-RGFQ

Bulletin has no description...

MINI-64FH-C6CW-R53W

Bulletin has no description...

MINI-73XC-4GFX-WQJ6

Bulletin has no description...

MINI-R9W4-76CQ-4VGF

Bulletin has no description...

MINI-F2RH-RPHP-35JH

Bulletin has no description...

EUVD-2026-59293

In the Linux kernel, the following vulnerability has been resolved: hwmon: aspeed-g6-pwm-tach Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeedtachvaltorpm function calculates the fan RPM using the tachometer value. However, it does no...

MINI-2HVJ-VX7F-Q8CQ

Bulletin has no description...

MINI-HVHG-5WJ7-93H6

Bulletin has no description...

CVE-2026-45819

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

CVE-2026-73418

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

CVE-2026-73418

NextAuth.js vulnerability CVE-2026-73418: The getToken() helper in next-auth/jwt and @auth/core/jwt can throw an uncaught exception when parsing a malformed Authorization: Bearer header, leading to a per-request denial of service. This occurs when no session cookie is present and the bearer value...

.NET: .NET Elevation of Privilege Vulnerability

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...

Improper Check for Unusual or Exceptional Conditions

Overview @auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the getToken function. An attacker can cause the application to throw an unhandled exception and disrupt service availability by sendi...

GHSA-XMF8-CVQR-RFGJ Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

Summary The exported getToken helper next-auth/jwt and @auth/core/jwt can throw an uncaught exception when it reads a malformed Authorization: Bearer … header. When no session cookie is present, getToken URL-decodes the bearer value before validating it, and malformed percent-encoding causes the...

CVE-2025-71391

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instan...