CVE-2026-45271 picotls has infinite recursion in the minicrypto ASN.1 decoder

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c...

CVE-2026-45271 picotls has infinite recursion in the minicrypto ASN.1 decoder

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c...

CVE-2026-45271

CVE-2026-45271 affects picotls , a TLS protocol library. The minicrypto backend 's ASN.1 validation helper recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. An attacker who can supply a crafted private-key file (via ptls_minicrypto_load_private_key())...

EUVD-2026-64165

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c...

CVE-2026-45271 picotls has infinite recursion in the minicrypto ASN.1 decoder

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c...

CVE-2026-31880 Combodo iTop: Reflected XSS in universal search

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

CVE-2026-31880 Combodo iTop: Reflected XSS in universal search

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

CVE-2026-31880

Combodo iTop , a web-based IT service management tool, is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search feature. The flaw allows an authenticated attacker (low privileges required, user interaction required) to inject malicious scripts via the search int...

CVE-2026-31880 Combodo iTop: Reflected XSS in universal search

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

EUVD-2026-64164

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

GHSA-2943-5XFG-GQ5F JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.jsL1863-L1871 This was fixed in...

Prototype Pollution

Overview jsonata is a JSON query and transformation language Affected versions of this package are vulnerable to Prototype Pollution via unsafe object creation patterns throughout the codebase src/jsonata.js, src/functions.js, src/parser.js, src/signature.js, and src/datetime.js. An attacker who...

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.jsL1863-L1871 This was fixed in...

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions 1.8.8...

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Summary hydra.utils.instantiate resolves and calls Python objects from config. If an application passes untrusted config to instantiate, an attacker who controls target and its arguments can cause arbitrary code execution in the consuming process. Hydra is not a network service. Exploitation...

GHSA-2CP2-2R3C-7P7R Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Summary hydra.utils.instantiate resolves and calls Python objects from config. If an application passes untrusted config to instantiate, an attacker who controls target and its arguments can cause arbitrary code execution in the consuming process. Hydra is not a network service. Exploitation...

CVE-2026-68508

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...

GHSA-5H77-88J3-R659 YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Summary YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer...

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Summary YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer...

JSONata: Arbitrary Code Execution via crafted JSONata expressions

Impact Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.jsL1686-L1705 This was fixed wi...