PT-2026-93112

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.5.2 Description An issue exists where block-level edit-permission checks are not enforced on the Express Form block's control-management actions. The system relies exclusively on CSRF Cross-Site Request...

CVE-2026-49250

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An...

EUVD-2026-77679

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An...

CVE-2026-49250 Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An...

CVE-2026-49250

Conform (a type-safe form validation library for JavaScript/TypeScript) contains a CPU exhaustion vulnerability in the parseSubmission future API (packages/conform-dom/formdata.ts). From version 1.8.0 through 1.19.3 , the parser repeatedly scans FormData or URLSearchParams entries for each unique...

CVE-2026-49250 Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An...

CVE-2026-49250 Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An...

Astra Linux - Vulnerability in Golang-1.23

The net/url package does not limit the number of query parameters in a query. Although the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing man...

Astra Linux – Vulnerability in Zabbix

Reflected XSS attacks occur when a malicious script is reflected from a web application into the victim’s browser. The script can be activated through action form fields, which are sent as requests to a website with vulnerabilities that allow the execution of malicious scripts...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Before versions 2.2.20, 3.1.18, and 3.2.3, Rack::RequestPOST would read the entire request body into memory when the Content-Type was application/x-www-form-urlencoded. This action did not enforce any length or capacity limits on the input. As a result...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. A lack of enforcement of an upper-bound limit on strings passed during IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions cleanipv6address and...

Astra Linux – Vulnerability in Golang-1.19

A denial of service may occur due to excessive resource consumption in the net/http and mime/multipart libraries. Parsing multipart forms using mime/multipart.Reader.ReadForm can consume a largely unlimited amount of memory and disk space. This issue also affects form parsing in the net/http...

Astra Linux – Vulnerability in Golang-1.19

Parsing multipart forms can consume large amounts of CPU and memory when processing form inputs containing a very large number of parts. This occurs due to several reasons: 1. The mime/multipart.Reader.ReadForm method limits the total memory that a parsed multipart form can consume. ReadForm may...

Astra Linux – Vulnerability in Tomcat9

An incorrect authorization vulnerability in Apache Tomcat’s FORM authentication process allows for bypassing a security constraint that restricts users’ access to resources via POST requests, but not via GET requests. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.24, from...

Astra Linux – Vulnerability in Netty

Netty is an asynchronous event-driven network application framework for rapid development of maintainable, high-performance protocol servers and clients. The HttpPostRequestDecoder can be configured to accumulate data. If enabled, the decoder can store items on the disk. There are no limitations ...

Astra Linux – Vulnerability in Firefox and Thunderbird

By displaying a form validation message in the correct location at the same time as a permission prompt such as for geolocation, the validation message could potentially obscure the prompt, allowing the user to be tricked into granting the permission. This vulnerability affects Firefox 94,...

Astra Linux – Vulnerability in Firefox

The login credentials saved by Firefox should be managed by the Password Manager component, which uses encryption to store files on disk. However, the username not the password was saved by the Form Manager to an unencrypted file on disk. This vulnerability affects Firefox versions earlier than 1...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - In net: The variable sk-skfamily was read once in the function skmcloop. - syzbot is frequently using IPV6ADDRFORM; it managed to trigger the WARNONONCE1 function in skmcloop. We still have many more similar issues that need...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: qat – A memory leak has been fixed in RSA operations. When a RSA key is represented in Form 2 as defined in PKCS 1 V2.1, some components of the private key persist even after the TFM Transaction Framework is released. To...

Astra Linux – Vulnerability in Golang-1.19

When parsing a multipart form—either explicitly using Request.ParseMultipartForm or implicitly using Request.FormValue, Request.PostFormValue, or Request.FormFile—limits on the total size of the parsed form were not applied to the memory consumed when reading a single form line. This allowed...