73027 matches found
CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
CVE-2026-102414
The pbkdf2 library (versions through 3.1.6 ) contains a vulnerability where passwords exceeding the digest's block size (64 bytes, or 128 bytes for sha384/sha512) are re-hashed on every iteration within the JavaScript fallback (lib/sync.js ). This results in a computational cost of O(iterations ×...
CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
CVE-2026-102372
GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers...
CVE-2026-102374
GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject...
CLEANSTART-2026-KE27596 js-yaml is a JavaScript YAML parser and dumper
CVE-2026-84375 affects multiple packages. js-yaml is a JavaScript YAML parser and dumper. See references for individual vulnerability details...
CLEANSTART-2026-QN85900 Picomatch is a glob matcher written JavaScript
Security vulnerability affects the argo-workflows package. Picomatch is a glob matcher written JavaScript...
CLEANSTART-2026-FU60890 moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates
Security vulnerability affects the argo-workflows package. moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates...
CLEANSTART-2026-AQ64279 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
Security vulnerability affects the apache-superset package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...
CLEANSTART-2026-JM61604 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
Security vulnerability affects the apache-superset package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...
CVE-2026-102374
Versions of GestSup prior to 3.2.62 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the IMAP OAuth connector . The root cause is the double-decoding of MIME-encoded email subjects after HTML escaping has already occurred. This allows unauthenticated attackers to send cr...
EUVD-2026-88596
GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers...
EUVD-2026-88566
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...
A Function-Level Dataset of Vulnerable and Fixed Source Code in JavaScript and TypeScript
JavaScript and TypeScript are widely used in modern web development, making their security critical; however, automated vulnerability detection is often constrained by the availability of high-quality training data. Here we present JsVul, a dataset curated from seven major sources. Unlike generic...
CVE-2026-102414
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
Linux Distros Unpatched Vulnerability : CVE-2026-101912
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in...
CVE-2026-102830: Improper Neutralization of Input During Web Page Generation
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...
CVE-2026-97711: Improper Neutralization of Input During Web Page Generation
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...
CVE-2026-100825: Use After Free
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...