10498 matches found
CVE-2025-69654
A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 2025-12-11,qjs interpreter using the -m option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JSFreeRuntime...
UBUNTU-CVE-2025-69654
A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 2025-12-11,qjs interpreter using the -m option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JSFreeRuntime...
CVE-2025-69654
A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 2025-12-11,qjs interpreter using the -m option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JSFreeRuntime...
Mercurius's queryDepth limit bypassed for WebSocket subscriptions
Description Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation...
GHSA-M4H2-MJFM-MP55 Mercurius's queryDepth limit bypassed for WebSocket subscriptions
Description Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation...
GHSA-46WH-PXPV-Q5GQ express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
Summary The default keyGenerator in express-rate-limit applies IPv6 subnet masking /56 by default to all addresses that net.isIPv6 returns true for. This includes IPv4-mapped IPv6 addresses ::ffff:x.x.x.x, which Node.js returns as request.ip on dual-stack servers. Because the first 80 bits of all...
@chrisleekr/mcp-server-playground (>=1.1.0-dev-1d08adb.1, <=1.1.0-dev-ff904e8.1) potentially affected by CVE-2026-30827 via express-rate-limit (8.0.1)
express-rate-limit NPM version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @chrisleekr/mcp-server-playground =1.1.0-dev-1d08adb.1, =1.1.0-dev-ff904e8.1 Source cves: CVE-2026-30827 Source advisory:...
@chrisleekr/mcp-server-playground (>=1.1.0-dev-1d08adb.1, <=1.1.0-dev-ff904e8.1) potentially affected by CVE-2026-30827 via express-rate-limit (8.0.1)
express-rate-limit NPM version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @chrisleekr/mcp-server-playground =1.1.0-dev-1d08adb.1, =1.1.0-dev-ff904e8.1 Source cves: CVE-2026-30827 Source advisory:...
@igea/oac_backend (>=1.0.35, <=1.0.119), @igea/oac_frontend (>=1.0.31, <=1.0.119) +10 more potentially affected by CVE-2026-30827 via express-rate-limit (8.1.0)
express-rate-limit NPM version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @igea/oacbackend =1.0.35, =1.0.31, =2.0.0-test.19, =0.29.0, =0.16.0, =0.42.0, =0.27.0, =0.42.0, =0.70.0, =0.22.0, =0.29.0,...
@chrisleekr/mcp-server-playground (>=1.1.0-dev-0d04f54.1, <=1.1.2), @luminati-io/luminati-proxy (>=1.597.450, <=1.601.281) +28 more potentially affected by CVE-2026-30827 via express-rate-limit (8.2.1)
express-rate-limit NPM version 8.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @chrisleekr/mcp-server-playground =1.1.0-dev-0d04f54.1, =1.597.450, =4.0.0, =3.1.0, =0.0.1-canary.1, =0.42.0, =0.20.0, =0.40....
@chrisleekr/mcp-server-playground (>=1.1.0-dev-0d04f54.1, <=1.1.2), @luminati-io/luminati-proxy (>=1.597.450, <=1.601.281) +28 more potentially affected by CVE-2026-30827 via express-rate-limit (8.2.1)
express-rate-limit NPM version 8.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @chrisleekr/mcp-server-playground =1.1.0-dev-0d04f54.1, =1.597.450, =4.0.0, =3.1.0, =0.0.1-canary.1, =0.42.0, =0.20.0, =0.40....
@chrisleekr/mcp-server-playground (>=1.1.0-dev-1d08adb.1, <=1.1.0-dev-ff904e8.1) potentially affected by CVE-2026-30827 via express-rate-limit (8.0.1)
express-rate-limit NPM version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @chrisleekr/mcp-server-playground =1.1.0-dev-1d08adb.1, =1.1.0-dev-ff904e8.1 Source cves: CVE-2026-30827 Source advisory:...
@igea/oac_backend (>=1.0.35, <=1.0.119), @igea/oac_frontend (>=1.0.31, <=1.0.119) +10 more potentially affected by CVE-2026-30827 via express-rate-limit (8.1.0)
express-rate-limit NPM version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @igea/oacbackend =1.0.35, =1.0.31, =2.0.0-test.19, =0.29.0, =0.16.0, =0.42.0, =0.27.0, =0.42.0, =0.70.0, =0.22.0, =0.29.0,...
@igea/oac_backend (>=1.0.35, <=1.0.119), @igea/oac_frontend (>=1.0.31, <=1.0.119) +10 more potentially affected by CVE-2026-30827 via express-rate-limit (8.1.0)
express-rate-limit NPM version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @igea/oacbackend =1.0.35, =1.0.31, =2.0.0-test.19, =0.29.0, =0.16.0, =0.42.0, =0.27.0, =0.42.0, =0.70.0, =0.22.0, =0.29.0,...
@chrisleekr/mcp-server-playground (>=1.1.0-dev-0d04f54.1, <=1.1.2), @luminati-io/luminati-proxy (>=1.597.450, <=1.601.281) +28 more potentially affected by CVE-2026-30827 via express-rate-limit (8.2.1)
express-rate-limit NPM version 8.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @chrisleekr/mcp-server-playground =1.1.0-dev-0d04f54.1, =1.597.450, =4.0.0, =3.1.0, =0.0.1-canary.1, =0.42.0, =0.20.0, =0.40....
Allocation of Resources Without Limits or Throttling
Overview express-rate-limit is a Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the ipKeyGenerator...
CLSA-2026-1772814085 Fix CVE(s): CVE-2026-26269
SECURITY UPDATE: Buffer overflow in netbeans specialkeys handling - debian/patches/CVE-2026-26269.patch: limit writing to max KEYBUFLEN bytes - CVE-2026-26269...
CLSA-2026-1772813746 php: Fix of CVE-2017-9119
CVE-2017-9119: handle memory limit error during string reallocation correctly...
CLSA-2026-1772812991 skopeo: Fix of 3 CVEs
rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVEs - CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory consumption during form parsing - CVE-2025-61729: fix excessive resource consumption when constructing hostname error messages...