CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

A flaw was found in node-csv, specifically within its csv-parse component. When configured with columns and groupcolumnsbyname options, a remote attacker can craft a malicious CSV header to manipulate the proto property. This allows the injection of attacker-controlled values into the parsed...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv (csv-parse) versions prior to 7.0.2 are vulnerable to a prototype replacement issue when the columns and group_columns_by_name options are enabled. In packages/csv-parse/lib/api/index.js, a duplicate __proto__ header in a CSV file is treated as an existing property, allowing an attacker-...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

PT-2026-85253

Name of the Vulnerable Software and Affected Versions node-csv versions prior to 7.0.2 Description When the columns and group columns by name options are enabled, the csv-parse component treats a duplicate proto header as an existing property in the packages/csv-parse/lib/api/index.js file. This...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

PT-2026-84880

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.6 fast-uri versions prior to 3.1.7 fast-uri versions prior to 4.1.4 Description The parse function fails to report an error when a host contains an unbalanced or misplaced authority bracket. A host starting with ...

CVE-2026-83611

xmldom (and @xmldom/xmldom ) is a pure JavaScript XML DOM parser. The vulnerability lies in DOMParser.parseFromString() , which can silently accept a malformed end tag where the tag name is followed by a line break and trailing content (e.g., ), closing the element and discarding the trailing con...

Linux Distros Unpatched Vulnerability : CVE-2026-80603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntrackirc: fix parsedcc off-by-one OOB read parsedcc treats dataend as an inclusive end pointer, but its only caller passes datalimit = ibptr +...

PT-2026-83519

A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse request of the file trick source/sim services/JSONVariableServer/JSONVariableServerThread.cpp of the component TCP Socket Handler. This manipulation causes stack-based buffer...

PT-2026-82903

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack irc: fix parse dcc off-by-one OOB read parse dcc treats data end as an inclusive end pointer, but its only caller passes data limit = ib ptr + datalen, which points one past the last valid byte. The newlin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nodejs-path-parse (UTSA-2026-093192)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093192 advisory. All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions...

The vulnerability of the `logicvc_drm_config_parse()` function in the `drivers/gpu/drm/logicvc/logicvc_drm.c` file of the Direct Rendering Infrastructure (DRI) driver module in the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the logicvcdrmconfigparse function in the drivers/gpu/drm/logicvc/logicvcdrm.c file of the Direct Rendering Infrastructure DRI driver module in the Linux kernel is related to improper memory release memory leak. Exploiting this vulnerability can allow a remote attacker to cau...

Astra Linux – Vulnerability in tinyxml

In the TiXmlDeclaration::Parse method in tinyxmlparser.cpp within TinyXML, up to version 2.6.2, there is a potentially exploitable assertion which can lead to application exit. This issue occurs when a malicious XML document is used, where a null character \0 is placed after a whitespace...

Astra Linux – Vulnerability in ncurses

A buffer overflow vulnerability exists in the postprocessterminfo function in tinfo/parseentry.c:997 within ncurses 6.1. This vulnerability allows remote attackers to cause a denial of service by using crafted commands...

Astra Linux – Vulnerability in binutils

A out-of-bounds read flaw was discovered in the parsemodule function in bfd/vms-alpha.c in Binutils...

Astra Linux – Vulnerability in libbpf

A vulnerability has been discovered in the Linux kernel. It has been identified as problematic. This issue affects the parseusdtarg function in the tools/lib/bpf/usdt.c file of the BPF component. Manipulating the regname argument leads to a memory leak. It is recommended that a patch be applied t...