CVE-2026-126800

Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when...

CVE-2026-126800

Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when...

CVE-2026-126800 Hydro @hydrooj/ui-default before 4.59.1 Stored XSS via Markdown language- Class

Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when...

EUVD-2026-124015

Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when...

CVE-2026-126800 Hydro @hydrooj/ui-default before 4.59.1 Stored XSS via Markdown language- Class

Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when...

CVE-2026-126800

The Hydro @hydrooj/ui-default package, specifically versions before 4.59.1 , is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is located in markdown-it-xss.ts , where the application fails to properly handle double quotes in language- class tokens. A registered u...

CVE-2026-126800: hydro-dev @hydrooj/ui-default: Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered…

Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when...

CVE-2026-55617

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-55617 Hydro: Insufficient session expiration when recreating sessions

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-55617 Hydro: Insufficient session expiration when recreating sessions

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-55617

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-55617 Hydro: Insufficient session expiration when recreating sessions

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

EUVD-2026-78768

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-55617

Hydro (the hydrooj NPM package), a high-performance online judge platform, contains an insufficient session expiration vulnerability in its session recreation logic (packages/hydrooj/src/service/layers/base.ts). From 4.10.4 through 5.0.1 , a new session token is created without deleting the previ...

CVE-2026-55617: Insufficient Session Expiration

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

ads-and (>=0.1.0, <=0.1.3), ads-bib (>=0.1.0, <=0.3.3) +12 more potentially affected by CVE-2026-9335 via keras (>=3.13.0, <=3.14.1)

keras PYPI version =3.13.0, =0.1.0, =0.1.0, =0.0.1, =0.3.4, =0.2.5, =0.1.0, =0.0.1, =1.3.1, =0.2.6, =1.24.0, =1.25.0 Source cves: CVE-2026-9335 Source advisory: OSV:PYSEC-2026-3633...

ads-and (>=0.1.0, <=0.1.3), ads-bib (>=0.1.0, <=0.3.3) +12 more potentially affected by CVE-2026-12482 via keras (>=3.13.0, <=3.14.1)

keras PYPI version =3.13.0, =0.1.0, =0.1.0, =0.0.1, =0.3.4, =0.2.5, =0.1.0, =0.0.1, =1.3.1, =0.2.6, =1.24.0, =1.25.0 Source cves: CVE-2026-12482 Source advisory: GHSA-58HV-7753-XMFQ...

bakaano-hydro (1.3.4), topologyx (1.1.0) potentially affected by CVE-2026-1669 via keras (>=3.13.0, <=3.13.1)

keras PYPI version =3.13.0, =3.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - bakaano-hydro 1.3.4 - topologyx 1.1.0 Source cves: CVE-2026-1669 Source advisory: OSV:PYSEC-2026-2546...

CVE-2026-42952

CVE-2026-42952 concerns the Hydro-Québec Le Circuit Électrique charging-station backend. The issue is an improper restriction of excessive authentication attempts due to lack of throttling, which could enable a denial-of-service condition. Technical details in the connected records indicate an ex...

GHSA-94JP-7776-QJ6Q Hydro: Insufficient session expiration when recreating sessions

Impact Hydro contains an insufficient session expiration vulnerability in its session recreation logic. When a session is recreated, including during logout or other session renewal flows, Hydro creates a new session token but does not delete the previous server-side session token. As a result, a...