PT-2026-103523

Name of the Vulnerable Software and Affected Versions garycourt uri-js versions prior to 4.4.2 Description A weakness in the Mailto Header Handler component allows a remote attacker to cause an uncaught exception. This occurs through the manipulation of arguments passed to the URI.parse function...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772617597)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772617597 advisory. - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to...

NPM: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

NPM: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.4.0...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

CVE-2026-7192

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

CVE-2026-40579

参考文献 https://github.com/steveukx/git-js/security/advisories/GHSA-mr9g-9pv2-x45j https://vulners.com/cve/CVE-2026-40579...

EUVD-2026-88758

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

CVE-2026-7192

The Dbit T-CPE301K 4G Mini WiFi Router is susceptible to a stack-based buffer overflow vulnerability. An authenticated attacker can trigger a denial of service (DoS) and a system reboot by sending a manipulated HTTP POST request to the /js/common/do_cmd.js endpoint. The vulnerability is caused by...

CVE-2026-7192 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

CVE-2026-7192 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

ROOT-APP-NPM-CVE-2026-48068 CVE-2026-48068 in @grpc/grpc-js - Patched by Root

Root has patched CVE-2026-48068 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available...

CVE-2026-101916

A flaw was found in grpc-js. In configurations where client certificates are optional, the authentication context lookup fails to distinguish between authorized and unauthorized peer certificates. A remote attacker can exploit this vulnerability by presenting an untrusted certificate, allowing th...

CLEANSTART-2026-RI71860 js-yaml is a JavaScript YAML parser and dumper

Security vulnerability affects the argo-workflows package. js-yaml is a JavaScript YAML parser and dumper...

weakrng-sweep

weak-rng スイープ（CVE-2026-71851 クラス） 調査ツール：PRNG スキーム × uint32 シードを列挙し、BIP39 ウォレットを導出し、 被害者アドレス集合に対するメンバーシップをチェックします（防御的調査、illbloom スタイル）。 スキーム：0-10（illbloom：MT19937/glibc/Java/LCG/xorshift）、11-13（glibc-31 LCG）、 14-15（crypto-js 3.3.0 WordArray.random MWC 移植版、node とのバイト検証済み）。 実行方法：Actions - mwc-sweep ...

CVE-2025-44998

CVE-2025-44998 요약 TinyFileManager v2.4.7의 /tinyfilemanager.php 구성 요소에 저장형 교차 사이트 스크립팅XSS 취약점이 존재합니다. 공격자는 js-theme-3 매개변수에 조작된 페이로드를 주입하여 임의의 JavaScript 또는 HTML을 실행할 수 있습니다. PoC 취약점을 확인하려면 설정 페이지url: http://localhost/index.php?p=&settings=1로 이동하세요. 요청을 보내는 동안 js-theme-3 매개변수 값을 다음 페이로드로 수정하세요:...

Partial String Comparison

Overview @grpc/grpc-js-xds is a Plugin for @grpc/grpc-js. Adds the xds:// URL scheme and associated features. Affected versions of this package are vulnerable to Partial String Comparison via the PathExactValueMatcher.apply method in matcher.ts, where the case-insensitive exact path match...

Server-generated Error Message Containing Sensitive Information

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Server-generated Error Message Containing Sensitive Information via the server-side RPC error handler in server.ts, which unconditionally includes the raw exception message in the gRPC status...

Improper Certificate Validation

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Improper Certificate Validation via getAuthContext in server-interceptors.ts and the TLS session handling in transport.ts, where the authorized property of a TLS socket is not checked before...

AZL-105075 CVE-2026-102276 affecting package js-jquery 3.5.0-4

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and use...

CVE-2026-101916

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...