EUVD-2026-125254

NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding...

CVE-2026-126267

NocoDB versions from 0.300.0 before 2026.04.4 are vulnerable to a Denial of Service (DoS) attack. The issue stems from an unhandled promise rejection within MetaService metadata logging . An authenticated user can trigger the crash by sending a request that leaves a lookup condition undefined, le...

DeadDialect

DeadDialect Every boot speaks a different language. Yesterday's binary is today's dead code. A session-unique RISC-V ISA remapping system. Every time the system boots, it generates a fresh cryptographic permutation of the instruction set. Binaries compiled for one session are cryptographically...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Post-Quantum KEM Timing Side-Channel Kyber Decapsulation Overview A vulnerable implementation of the Kyber KEM decapsulation leaks secret key bits through timing differences in the ciphertext rejection step, enabling full key recovery. Severity: Critical Private Key Compromise...

ply_exploit_rejection

Ply 3.11 Exploit Rejection This project argues that CVE‑2025‑56005 be rejected. Argument 1: The Proof of Concept does not complete sucessfully In this project the code from the proof of concept has been copied to main.py. Run the proof of concept To run the exploit ensure that you have installed ...

CVE-2026-123746

The Symfony Security HTTP component AuthenticatorManager::authenticateUser does not run the firewall user checker’s checkPostAuth method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony...

CVE-2026-123562

devalue sveltejs/devalue 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker...

CVE-2026-123562 Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection

devalue sveltejs/devalue 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker...

CVE-2026-123562

The devalue (sveltejs/devalue) library versions 5.8.0 before 5.9.3 is vulnerable to a Denial of Service via an unhandled promise rejection in the stringifyAsync function. When serializing multiple promises, if a later promise rejects before an earlier one settles, an internal rejection remains un...

EUVD-2026-119447

devalue sveltejs/devalue 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker...

CVE-2026-123561 Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion

devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's proto rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a proto own property, which alone does not cause prototype...

CVE-2026-123561 Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion

devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's proto rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a proto own property, which alone does not cause prototype...

CVE-2026-123561

The devalue library (versions before 5.9.3 ) is vulnerable to a __proto__ rejection bypass via property-key coercion. This vulnerability occurs when malformed null-prototype object keys are processed, allowing crafted payloads to yield objects with a __proto__ own property . While this consti...

CVE-2026-123561 Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion

devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's proto rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a proto own property, which alone does not cause prototype...

CVE-2026-123562: sveltejs devalue: devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when…

devalue sveltejs/devalue 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker...

PT-2026-139843

devalue sveltejs/devalue 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker...

CVE-2026-123746

The Symfony Security HTTP component AuthenticatorManager::authenticateUser does not run the firewall user checker’s checkPostAuth method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony...

CVE-2026-44519 liboqs: Missing value barrier in FO implicit rejection path (FrodoKEM, NTRU, and others)

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, the ctselect function in src/kem/frodokem/external/util.c for the FrodoKEM-640, FrodoKEM-976, and FrodoKEM-1344 AES and SHAKE reference variants lacks a value barri...

CVE-2026-44519 liboqs: Missing value barrier in FO implicit rejection path (FrodoKEM, NTRU, and others)

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, the ctselect function in src/kem/frodokem/external/util.c for the FrodoKEM-640, FrodoKEM-976, and FrodoKEM-1344 AES and SHAKE reference variants lacks a value barri...

CVE-2026-44519 liboqs: Missing value barrier in FO implicit rejection path (FrodoKEM, NTRU, and others)

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, the ctselect function in src/kem/frodokem/external/util.c for the FrodoKEM-640, FrodoKEM-976, and FrodoKEM-1344 AES and SHAKE reference variants lacks a value barri...