CVE-2026-110717

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

CVE-2026-110717

The Janus WebRTC Server (versions through 1.4.3 ) contains a path traversal vulnerability within the Record&Play plugin . This flaw allows unauthenticated attackers to bypass the recordings_path restriction by supplying filenames with path separators during a record request. Consequently, attacke...

CVE-2026-110717 Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

CVE-2026-110717 Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

EUVD-2026-101140

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

CVE-2026-110717 Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

CVE-2026-110714

The libsmb2 library, versions through 6.2 , is vulnerable to a heap out-of-bounds read caused by an integer underflow in the decode_acl function. A malicious SMB server or an attacker intercepting an unsigned session can trigger this by sending a crafted QUERY_INFO reply with an AclSize value bel...

CVE-2026-110712

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

EUVD-2026-101135

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-101895

The @angular/platform-server DOM emulation parser is vulnerable to an infinite synchronous loop when processing attacker-controlled HTML containing an incomplete DOCTYPE ending with whitespace. This occurs in Domino lib/HTMLParser.js because the after_doctype_name_state emits tokens without advan...

CVE-2026-101895

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

CVE-2026-101895 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-101895 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@nk-spirit/nk-ngx-bootstrap (7.1.16) potentially affected by CVE-2026-101895 via @angular/platform-server (11.2.0)

@angular/platform-server NPM version 11.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @nk-spirit/nk-ngx-bootstrap 7.1.16 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

angular-store-locator (>=0.0.1, <=0.1.0), angular5-canvas-drawer (1.6.5) +2 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=8.2.0, <=8.2.12)

@angular/platform-server NPM version =8.2.0, =0.0.1, =1.0.135, =2.0.20 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-101895 via @angular/platform-server (18.2.13)

@angular/platform-server NPM version 18.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.0, =1.0.4 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@flowaccount/scullyio (1.0.0), @flowaccount/scullyio-scully (>=2.0.0, <=2.0.14) +21 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=12.2.6, <=12.2.15)

@angular/platform-server NPM version =12.2.6, =2.0.0, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.32, =2.1.41 and more Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@hmcts/annotation-ui (1.0.0), @hmcts/annotation-ui-lib (>=1.0.1, <=1.0.2-RC) +10 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=6.1.0, <=6.1.9)

@angular/platform-server NPM version =6.1.0, =1.0.1, =1.1.8-bata.1, =2.0.0, =1.23.14, =1.0.634, =1.0.635 - shivs-angular5-painter 1.1.0 - totvs-thf2-components 0.0.2 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...

@proactive-as/angular.vendor (7.2.13), @sitespirit/mediaspirit-module (>=0.0.71, <=7.2.17) +3 more potentially affected by CVE-2026-101895 via @angular/platform-server (>=7.2.4, <=7.2.15)

@angular/platform-server NPM version =7.2.4, =0.0.71, =0.0.2, =0.0.1-1.1, =2.0.11, =2.1.499 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...