CVE-2026-7192

The Dbit T-CPE301K 4G Mini WiFi Router is susceptible to a stack-based buffer overflow vulnerability. An authenticated attacker can trigger a denial of service (DoS) and a system reboot by sending a manipulated HTTP POST request to the /js/common/do_cmd.js endpoint. The vulnerability is caused by...

CVE-2026-7192 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

CVE-2026-7192 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

ROOT-APP-NPM-CVE-2026-48068 CVE-2026-48068 in @grpc/grpc-js - Patched by Root

Root has patched CVE-2026-48068 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available...

CVE-2026-101916

A flaw was found in grpc-js. In configurations where client certificates are optional, the authentication context lookup fails to distinguish between authorized and unauthorized peer certificates. A remote attacker can exploit this vulnerability by presenting an untrusted certificate, allowing th...

CLEANSTART-2026-RI71860 js-yaml is a JavaScript YAML parser and dumper

Security vulnerability affects the argo-workflows package. js-yaml is a JavaScript YAML parser and dumper...

CVE-2026-7192: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

Partial String Comparison

Overview @grpc/grpc-js-xds is a Plugin for @grpc/grpc-js. Adds the xds:// URL scheme and associated features. Affected versions of this package are vulnerable to Partial String Comparison via the PathExactValueMatcher.apply method in matcher.ts, where the case-insensitive exact path match...

Server-generated Error Message Containing Sensitive Information

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Server-generated Error Message Containing Sensitive Information via the server-side RPC error handler in server.ts, which unconditionally includes the raw exception message in the gRPC status...

Improper Certificate Validation

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Improper Certificate Validation via getAuthContext in server-interceptors.ts and the TLS session handling in transport.ts, where the authorized property of a TLS socket is not checked before...

AZL-105075 CVE-2026-102276 affecting package js-jquery 3.5.0-4

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and use...

CVE-2026-101916

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101915

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

CVE-2026-101914

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path method name matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service...

CVE-2026-101916 @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101916 @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101916

The @grpc/grpc-js library (versions prior to 1.13.6 and 1.14.5 ) contains a vulnerability where the getAuthContext function fails to distinguish between authorized and unauthorized peer certificates. This occurs specifically when server credentials have requireClientCertificate set to false . If ...

CVE-2026-101916 @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101915 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

CVE-2026-101915 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...