hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...

CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations

A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm ECDSA or SM2, using curves withou...

openssl: OpenSSL: Private key recovery via SM2 timing side-channel

A flaw was found in OpenSSL. During SM2 signature generation, variable-time arithmetic operations are performed on secret values, creating an observable timing side-channel. An attacker capable of measuring signature generation times can collect timing data across multiple signing operations, whi...

openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V

A flaw was found in OpenSSL. The optimized scalar point multiplication used for SM2 cryptographic operations on ARM64 and RISC-V architectures does not execute in constant time. An attacker capable of measuring execution times or observing processor cache-access patterns can exploit this side...

CVE-2025-55182-Metasploit-exploit-skeleton-real-flow-

🧪 PASO 1: Aplicación web vulnerable de demostración LAB Creamos una lógica similar a CVE-2025-55182 ejecución insegura en el lado del servidor. 📁 vulnapp/app.py from flask import Flask, request import subprocess app = Flaskname @app.route"/render", methods="POST" def render: data =...

openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations

A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm ECDSA or SM2, using curves withou...

openssl: OpenSSL: Private key recovery via SM2 timing side-channel

A flaw was found in OpenSSL. During SM2 signature generation, variable-time arithmetic operations are performed on secret values, creating an observable timing side-channel. An attacker capable of measuring signature generation times can collect timing data across multiple signing operations, whi...

CVE-2026-101883

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

chromium-browser: skia: chromium-browser: skia: Side-channel information leakage in Skia

A side-channel information leakage flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=506377118...

CVE-2026-102142 Kiteworks Core Remote Code Execution through Server-Side Template Injection

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...

CVE-2026-102146

The Kiteworks Email Protection Gateway is vulnerable to an Arbitrary File Write vulnerability caused by Server-Side Template Injection . An authenticated administrator with limited, delegated permissions can exploit this to write files with attacker-controlled content to arbitrary locations acces...

CVE-2026-102146 Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...

CVE-2026-102146 Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...

CLEANSTART-2026-MF73184 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

Security vulnerability affects the containerd package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

EUVD-2026-90256

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-62308

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...