237 matches found
CLEANSTART-2026-CG38853 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions
Security vulnerability affects the frappe-helpdesk package. fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize and equal functions...
CLEANSTART-2026-AF49593 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions
Security vulnerability affects the argo-workflows package. fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize and equal functions...
CLEANSTART-2026-TN34828 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions
Security vulnerability affects the argo-workflows package. fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize and equal functions...
Improper Validation of Specified Quantity in Input
Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via canonicalizeHost, which passes the host directly to new URL'http://' + host without verifying that the WHATWG parser consumed the...
Improper Validation of Specified Quantity in Input
Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via canonicalizeHost, which passes the host directly to new URL'http://' + host without verifying that the WHATWG pars...
PT-2026-119046
A segmentation violation in the gf props equal internal function /filter core/filter props.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted data file...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current isize including 0, the code used to call checklockrangefilp, isize, size - 1, WRITE, which computes size - 1 and can underflow for...
Astra Linux – vulnerability in linux-5.10, linux, linux-5.15
In the Linux kernel, the following vulnerability has been resolved: modpost: fix off by one in isexecutablesection The comparison should be = to prevent an out of bounds array access...
GHSA-QW65-CVWX-89V3 fast-uri vulnerable to authority injection via an unvalidated port in serialize
Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...
fast-uri vulnerable to authority injection via an unvalidated port in serialize
Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...
CVE-2026-54541 Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify call...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cifs-utils (UTSA-2026-054012)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054012 advisory. cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign characters but is not a valid credentials file. Tenabl...
Malicious code in equal-turquoise-cicada (npm)
Source: amazon-inspector edd228d559a82b995a9e6128e1dfcdf41aa5392539db14b9dfa45f998129baf6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in equal-jade-damselfly (npm)
Source: amazon-inspector eb414a397d4e983d8b94a560ba15581a53e3a678babcf905dec91b369813c117 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in equal-scarlet-owl (npm)
Source: amazon-inspector 865337e196bb57a9e9e0c1ee0c5f582418cbb2f57153141c708f9c6bb874d09b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in equal-olive-zebra (npm)
Source: amazon-inspector 92914c9c99a4b61d0c4b1c83c89ed8fbc31f277bc0b7d09c163ed6c8082f666d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in equal-black-lark (npm)
Source: amazon-inspector f4bf678681807bc4adddb7a719ec54efd09f8b094cf8c1b9a401291e73ddef40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in equal-coral-flyingfish (npm)
Source: amazon-inspector 4d82a1955feb859137b60d22412fcbd2f48d94dcd591533246ff390effae03bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in equal-azure-mongoose (npm)
Source: amazon-inspector 79966acc0ff3ab5d6538f2f6629f0117d35a775e15e348b8368edef51cbe13db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in equal-chocolate-jaguar (npm)
Source: amazon-inspector ff3e0664cb0930af4c469e773a480d937b576f02d3217330bf074b3e13314b6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...