body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

Impact When body-parser is configured with an invalid limit option value, such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept...

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

CVE-2026-44510

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recvfiles lets a malicious rsync server or any peer acting in the sender role deterministically crash any rsyn...

GHSA-83XP-526H-J3WW File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

Summary The fix for GHSA-gxjx-7m74-hcq8 / CVE-2026-54093 shipped in v2.63.6 added a strings.ReplaceAllnameInArchive, "\", "/" step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it...

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

Summary The fix for GHSA-gxjx-7m74-hcq8 / CVE-2026-54093 shipped in v2.63.6 added a strings.ReplaceAllnameInArchive, "\", "/" step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it...

GHSA-23HP-3JRH-7FPW node-tar: Decompression/parse DoS via unlimited input

Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...

node-tar: Decompression/parse DoS via unlimited input

Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...

GHSA-QFRW-5RXM-MHH2 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Summary Type: URL-scheme allowlist gap. The safeurl filter only blocks the four schemes javascript:, vbscript:, file:, data:. Several other schemes are accepted into rendered and tags despite being known XSS vectors in legacy or chain-handling browsers. The same gap applies to direct links,...

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Summary Type: URL-scheme allowlist gap. The safeurl filter only blocks the four schemes javascript:, vbscript:, file:, data:. Several other schemes are accepted into rendered and tags despite being known XSS vectors in legacy or chain-handling browsers. The same gap applies to direct links,...

CVE-2026-53596

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-44510

CVE-2026-44510 affects rsync versions prior to 3.4.3. The vulnerability is a receiver‑side out-of-bounds read in rsync’s recv_files(), triggered by a malicious server during a normal recursive pull via rsync:// or SSH/rsh, by manipulating the protocol (CF_INC_RECURSE and a specially crafted trans...

CVE-2026-44510 Rsync: Receiver-side out-of-bounds read enables remote DoS from malicious server

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recvfiles lets a malicious rsync server or any peer acting in the sender role deterministically crash any rsyn...

CVE-2026-44510

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recvfiles lets a malicious rsync server or any peer acting in the sender role deterministically crash any rsyn...

EUVD-2026-46111

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recvfiles lets a malicious rsync server or any peer acting in the sender role deterministically crash any rsyn...

BIT-NGINX-GATEWAY-2026-60005 NGINX ngx_http_slice_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX...

BIT-NGINX-2026-60005 NGINX ngx_http_slice_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX...

BIT-NGINX-GATEWAY-2026-42533 NGINX Map directive and Regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...

BIT-NGINX-2026-42533 NGINX Map directive and Regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...