1171 matches found
CVE-2025-4396
CVE-2025-4396 — Relevanssi SQL Injection Time-Based Blind Disclaimer: This repository is intended for authorized penetration testing, security research, and educational purposes only. Unauthorized access to computer systems is illegal and unethical. Overview A proof-of-concept exploit for a...
CLEANSTART-2026-YZ09007 ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion
Security vulnerability affects the argo-workflows package. Summary The arrayLimit option in qs does not enforce limits for comma-separated values when comma: true is enabled, allowing attackers to cause denial-of-service via memory exhaustion...
Qs : Qs.stringify With ArrayFormat 'comma' Throws An Uncaught TypeError On Array Elements Carrying A Non-callable Own To
Summary "qs.stringifyobj, arrayFormat: 'comma' " throws an uncaught "TypeError: Cannot convert object to primitive value" when an array in "obj" contains an element that carries an own, non-callable "toString" property for example " a: toString: 'x' ". A remote, unauthenticated attacker who can...
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
Summary qs.stringifyobj, arrayFormat: 'comma' throws an uncaught TypeError: Cannot convert object to primitive value when an array in obj contains an element that carries an own, non-callable toString property for example a: toString: 'x' . A remote, unauthenticated attacker who can influence an...
GHSA-6PQ8-JHM2-2VCW qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
Summary qs.stringifyobj, arrayFormat: 'comma' throws an uncaught TypeError: Cannot convert object to primitive value when an array in obj contains an element that carries an own, non-callable toString property for example a: toString: 'x' . A remote, unauthenticated attacker who can influence an...
npm: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
npm: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString DoS vulnerability discovered by ? in WordPress npm qs versions = 6.7.0, = 6.16.0...
EUVD-2026-101710
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString DoS...
Astra Linux – vulnerability in openssh
OpenSSH versions prior to 10.3 mishandle the authorizedkeys principals option in unusual scenarios involving a principals list alongside a Certificate Authority that utilizes certain comma characters...
SUSE CVE-2026-8723
Summary qs.stringify throws TypeError when called with arrayFormat: 'comma' and encodeValuesOnly: true on an array containing null or undefined. The throw is synchronous and not handled by any of qs's null-related options skipNulls, strictNullHandling. Details In the comma + encodeValuesOnly...
Linux Distros Unpatched Vulnerability : CVE-2026-110816
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Summary qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string,...
SUSE CVE-2026-110816
Summary qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString "toString": "x" or a null-prototype object. The comma format joins array elements with...
UBUNTU-CVE-2026-110816
Summary qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString "toString": "x" or a null-prototype object. The comma format joins array elements with...
Uncaught Exception
Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception via stringify when arrayFormat: 'comma' is used with array elements that have a non-callable toString property. Such elements - as...
Uncaught Exception
Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception via stringify when arrayFormat: 'comma' is used with array elements that have a non-callable toString property. Such...
CVE-2026-110816
A flaw was found in qs. A remote attacker could cause a Denial of Service DoS by supplying specially crafted input to an application that re-serializes data using the comma array format. Because the library fails to safely handle array elements that cannot be converted to a string, an unhandled...
AZL-108309 CVE-2026-110816 affecting package js-jquery 3.5.0-4
Summary qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString "toString": "x" or a null-prototype object. The comma format joins array elements with...
AZL-108477 CVE-2026-110816 affecting package python-tensorboard 2.16.2-6
Summary qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString "toString": "x" or a null-prototype object. The comma format joins array elements with...
CVE-2026-110816
Summary qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString "toString": "x" or a null-prototype object. The comma format joins array elements with...
DEBIAN-CVE-2026-110816
Summary qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString "toString": "x" or a null-prototype object. The comma format joins array elements with...
CVE-2026-110816
Summary qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString "toString": "x" or a null-prototype object. The comma format joins array elements with...