CVE-2026-101911 ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

CVE-2026-101911 ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

GO-2026-6515 Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose...

EUVD-2026-85327

scim-patch: Mutation of Inherited Built-in Method Objects...

scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

GHSA-2MHW-WCX5-V3XJ scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 Vulnerability Details CVEID:CVE-2026-41710 DESCRIPTION: An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache ...

CVE-2017-7921-EXPLOIT

CVE-2017-7921 - Hikvision カメラシリーズにおける不適切な認証の脆弱性 CVE-2017-7921 として識別されるセキュリティ上の欠陥で、Hikvision カメラのさまざまなモデルに影響を与えます。この脆弱性は、DS-2CD2xx2F-I シリーズ（V5.2.0 build 140721 から V5.4.0 build 160530）、DS-2CD2xx0F-I シリーズ（V5.2.0 build 140721 から V5.4.0 Build 160401）、DS-2CD2xx2FWD シリーズ（V5.3.1 build 150410 から V5.4.4...

CVE-2026-82936 Denial of Service in mH-DEVELOPER

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in...

PT-2026-99915

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description A flaw in the boa temp Handler component allows remote attackers to bypass authentication. This issue occurs within the process request function, enabling unauthorized access to be carried out...

CVE-2026-102006: Missing Release of Memory after Effective Lifetime

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09...

CVE-2026-101911: Uncontrolled Resource Consumption

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100722

The vm2 library before version 3.12.2 is vulnerable to a host process termination due to a flaw in the sandbox-to-host construct trap . Specifically, the BaseHandler fails to apply host-side Promise rejection handling when the apply trap calls markHostPromiseHandled() on a returned value, while t...

CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100722: Uncaught Exception

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100642

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

Symlink Attack

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Symlink Attack via the DataDump cron process due to insufficient validation of intermediate path components in the export destination. An attacker can gain unauthorized ownership of...

CVE-2026-100701

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports secure: true resolve the same non-IP host with different tls.servername values, t...