CVE-2026-33810

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +639 more potentially affected by CVE-2026-39410 via hono (>=4.0.0, <=4.12.10)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2026.4.4, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.70 and more Source cves: CVE-2026-39410 Source advisory: OSV:GHSA-R5RP-J6WH-RVV4...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +639 more potentially affected by CVE-2026-39409 via hono (>=4.0.0, <=4.12.10)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2026.4.4, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.70 and more Source cves: CVE-2026-39409 Source advisory: OSV:GHSA-XPCF-PG52-R92G...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +639 more potentially affected by unknown CVE via hono (>=4.0.0, <=4.12.10)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2026.4.4, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.70 and more Source cves: unknown CVE Source advisory: SNYK:JS-HONO-15928831...

0xble (>=21.4.1, <=22.1.2), @10xsai/ts-serverless (>=0.1.0, <=0.1.1) +1840 more potentially affected by CVE-2026-39356 via drizzle-orm (>=0.37.0, <=0.45.1)

drizzle-orm NPM version =0.37.0, =21.4.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.22.5, =0.1.0, =1.16.47-beta-20250723-114212-8da08071, =1.16.47-beta-20250723-114212-8da08071, =1.17.8-beta-20260115-130425-5c8d9a61 and more Source cves: CVE-2026-39356...

EUVD-2026-19728

Emissary has GitHub Actions Shell Injection via Workflow Inputs...

Emissary has GitHub Actions Shell Injection via Workflow Inputs

Summary Three GitHub Actions workflow files contained 10 shell injection points where user-controlled workflowdispatch inputs were interpolated directly into shell commands via $ expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to reposito...

GHSA-3G6G-GQ4R-XJM9 Emissary has GitHub Actions Shell Injection via Workflow Inputs

Summary Three GitHub Actions workflow files contained 10 shell injection points where user-controlled workflowdispatch inputs were interpolated directly into shell commands via $ expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to reposito...

EUVD-2026-19736

pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng...

pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

Summary The ADMINONLYCOREOPTIONS authorization set in setconfigvalue uses incorrect option names sslcert and sslkey, while the actual configuration option names are sslcertfile and sslkeyfile. This name mismatch causes the admin-only check to always evaluate to False, allowing any user with...

PT-2026-31352

Name of the Vulnerable Software and Affected Versions kcp versions prior to 0.30.3 and prior to 0.29.3 Description Prior to versions 0.30.3 and 0.29.3, the cache server in kcp is directly exposed by the root shard without authentication or authorization. This allows anyone who can access the root...

Google Go security vulnerabilities

Google Go is a static, strongly typed, compiled, concurrent programming language with garbage collection features from the American company Google. There is a security vulnerability in Google Go, which stems from improper limitation of work quantities during the chain construction process,...

MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security

The Model Context Protocol MCP enables large language models LLMs to dynamically discover and invoke third-party tools, significantly expanding agent capabilities while introducing a distinct security landscape. Unlike prompt-only interactions, MCP exposes pre-execution artifacts, shared context,...

PT-2026-31351

Summary The sort natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary e.g., multi-tenant template syste...

PT-2026-41279

Name of the Vulnerable Software and Affected Versions DAEMON Tools Lite versions 12.5.0.2421 through 12.5.0.2434 Description A supply chain attack compromised official installation packages distributed via the legitimate website daemon-tools.cc between April 8, 2026, and May 5, 2026. Attackers...

Juniper Junos OS Vulnerability (JSA107823)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA107823 advisory. - An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper Networks Junos OS on SRX Series allows a PITM to intercept the communication of...

Broken Quantum: A Systematic Formal Verification Study of Security Vulnerabilities across the Open-Source Quantum Computing Simulator Ecosystem

Quantum computing simulators form the classical software foundation on which virtually all quantum algorithm research depends. We present Broken Quantum, the first comprehensive formal security audit of the open-source quantum computing simulator ecosystem. Applying COBALT QAI -- a four-module...

Google Go security vulnerabilities

Google Go is a static, strongly typed, compiled, concurrent programming language with garbage collection features from the American company Google. There is a security vulnerability in Google Go, which stems from inefficient verification of the certificate chain used for validation strategies,...

CVE-2026-32280: Allocation of Resources Without Limits or Throttling

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls...

Improper Handling of Case Sensitivity

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity. Go Vulnerability Report: When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly...