CVE-2026-83615

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:32+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g...

CVE-2026-83613

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:28+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6...

CVE-2026-83611

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:21+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59...

CVE-2026-83618

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:19+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp...

CVE-2026-83609

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:17+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-3px3-54cx-rmw9...

CVE-2026-83608

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:14+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv...

CVE-2026-83617

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:12+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944...

CVE-2026-83616

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:10+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv...

CVE-2026-84308

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:07+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-q97c-8qh3-fpc6...

CVE-2026-86081

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8NBLOCKFILEPATTERNS regular expression. The pattern ^./.git/.$ allowed catastrophic backtracking and ran...

CVE-2026-86075

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." Microsoft notes that 2 of the vulnerabilities disclosed this month have been exploited in the wild:...

CVE-2026-31912

A flaw was found in libpcap. The BPF interpreter in libpcap does not correctly handle crafted filter programs, leading to an out-of-bounds read. A local attacker could provide a specially crafted filter program, causing the interpreter to attempt to read memory outside of its allocated buffer. Th...

Inefficient Algorithmic Complexity

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the addressparser function in lib/addressparser/index.js. An attacker can block the Node.js event loop by supplying a...

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Summary Nodemailer's address parser lib/addressparser/index.js parses a list of comma‑separated addresses in quadratic time — On² in the number of addresses. A single crafted address string e.g. a To, Cc, Bcc, From, or Reply‑To value, or any value passed to the exported addressparser therefore...

GHSA-2X7J-588G-CCC2 Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Summary Nodemailer's address parser lib/addressparser/index.js parses a list of comma‑separated addresses in quadratic time — On² in the number of addresses. A single crafted address string e.g. a To, Cc, Bcc, From, or Reply‑To value, or any value passed to the exported addressparser therefore...

CVE-2026-83612

creationtimestamp| type| source ---|---|--- 2026-09-08 21:33:08+00:00| seen| https://gist.github.com/alon710/6001224d6aa2414b1f8b69a0a75f3dac 2026-09-08 22:35:37+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw...

EUVD-2026-67930

multer vulnerable to Denial of Service via crafted multipart field names...

multer vulnerable to Denial of Service via crafted multipart field names

Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the...

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

Impact A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service DoS by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file...