CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

EUVD-2026-67585

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

CVE-2026-82259

SvelteKit versions 2.49.0 through 2.53.2 (fixed in 2.53.3 ) are affected by a deserialization expansion vulnerability in the experimental form remote function . When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files....

CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

EUVD-2026-67582

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82256

SvelteKit versions prior to 2.69.1 contain a denial-of-service vulnerability in its remote form function handling. The root cause is a failure to properly validate payload sizes, allowing an unauthenticated network attacker to crash the Node process by sending abnormally large payloads. Repeated ...

CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82254

gitoxide before 0.69.0 is vulnerable to denial of service via its gix-pack component. The root cause is unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers . An attacker can send crafted pack data during clone or fetch operations to trigger ...

EUVD-2026-67706

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

CVE-2026-82254 gitoxide before 0.69.0 Denial of Service via gix-pack

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

CVE-2026-82254 gitoxide before 0.69.0 Denial of Service via gix-pack

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

CVE-2026-82250

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation triggered when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to cause an index out of bounds panic , aborting the client p...

CVE-2026-82250 gitoxide gix-packetline before 0.21.5 Denial of Service

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the clien...

CVE-2026-82250 gitoxide gix-packetline before 0.21.5 Denial of Service

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the clien...

CVE-2026-82235

filebrowser through 2.63.23 fails to validate named pipes in its directory archive and public download handlers. This causes blocking open syscalls that pin server goroutines and exhaust connection resources, resulting in a denial of service . Both authenticated users and anonymous visitors with ...

EUVD-2026-67687

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

CVE-2026-82235 filebrowser through 2.63.23 Denial of Service via named pipes

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

CVE-2026-82235 filebrowser through 2.63.23 Denial of Service via named pipes

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

CVE-2023-23752-EXPLOIT

CVE-2023-23752 - Joomla Controllo di accesso improprio È stato identificato un problema nelle versioni di Joomla dalla 4.0.0 alla 4.2.7. Questa vulnerabilità è legata a un controllo di accesso improprio all'interno dell'applicazione, che consente l'accesso non autorizzato a endpoint critici del...