EUVD-2026-119352

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to...

NLnet Labs Unbound encryption issue vulnerability

Versions 1.0.1 through 1.26.1 of NLnet Labs Unbound contain an encryption-related vulnerability. This vulnerability arises because when configuring root trust anchors and additional trust-anchors, the DNSSEC validator accepts and caches forged NSEC responses that have SOA bits cleared, thereby...

EUVD-2026-73080

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion...

CLEANSTART-2026-JB83386 issue in the anchors subparser of Showdownjs versions <= 2

Security vulnerability affects the n8n package. An issue in the anchors subparser of Showdownjs versions = 2...

PT-2026-117782

Security vulnerability affects the n8n package. An issue in the anchors subparser of Showdownjs versions = 2...

CVE-2026-72923

The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 a...

PT-2026-87843

Name of the Vulnerable Software and Affected Versions Microsoft.OpenApi.YamlReader versions 2.0.0-preview.11 through 2.11.x Microsoft.OpenApi.YamlReader versions 3.0.0 through 3.9.x Microsoft.OpenApi.Readers versions prior to 1.6.30 Description Uncontrolled resource consumption occurs when parsin...

Malicious code in com.microsoft.azure.spatial-anchors-sdk.android (npm)

The package com.microsoft.azure.spatial-anchors-sdk.android was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in com.microsoft.azure.spatial-anchors-sdk.core (npm)

The package com.microsoft.azure.spatial-anchors-sdk.core was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in com.microsoft.azure.spatial-anchors-sdk.windows (npm)

The package com.microsoft.azure.spatial-anchors-sdk.windows was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in com.microsoft.azure.spatial-anchors-sdk.ios (npm)

The package com.microsoft.azure.spatial-anchors-sdk.ios was found to contain malicious code. --- Credit: OpenSSF source...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the removeScripts plugin due to incomplete filtering of executable links in plugins/removeScripts.js and lib/svgo/tools.js. An attacker can execute arbitrary scripts in the context of the SVG's origin, expose...

CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

AirKey: Multimodal Acoustic-Assisted WiFi Sensing for Zero-Training Robust PIN Inference

Contactless keystroke inference via WiFi sensing highlights severe privacy threats, yet its real-world feasibility is hindered by two fundamental physical and deployment bottlenecks: the strict requirement for network privileges to acquire stable sensing streams, and the inherent "waveform fusion...

CVE-2026-18089

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...

CVE-2026-18108 Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verifyencryptedassertion accepts an EncryptedAssertion whose decrypted content carries no signature. verifyencryptedassertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via...

CVE-2026-18089

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...

CVE-2026-18089

The Net::SAML2 Perl module (versions before 0.86 ) is vulnerable to a SAML authentication bypass . The root cause is located in Net::SAML2::Role::VerifyXML, where the verify_xml function returns early if no trust anchor ($anchors) or certificate ($cacert) is configured. Consequently, the system v...

EUVD-2026-52266

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...

CVE-2026-18089 Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...