50807 matches found
CVE-2026-56848
A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-15920
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...
CVE-2026-15830 Potential denial-of-service vulnerability via nested geometry collections
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...
CVE-2026-15830
An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...
EUVD-2026-52748
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...
CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...
CVE-2026-69250
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...
MAL-2026-11762 Malicious code in @ornikar/kitt2 (npm)
npm/@ornikar/kitt2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by t...
CLSA-2026-1785380881 TuxCare security update for ws (2 CVEs)
TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.16.0-tuxcare.2...
CLSA-2026-1785380887 TuxCare security update for mongoose (2 CVEs)
TuxCare rebuilt mongoose to address 2 CVEs. Fixed in 6.12.2-tuxcare.4...
CLSA-2026-1785380980 TuxCare security update for guzzlehttp/guzzle (2 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 6.0.2-p4+tuxcare...
CLSA-2026-1785554486 TuxCare security update for guzzlehttp/psr7 (2 CVEs)
TuxCare rebuilt guzzlehttp/psr7 to address 2 CVEs. Fixed in 1.4.2-p2+tuxcare...
CLSA-2026-1785814912 TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 19 org.springframework.security packages to address 2 CVEs. Fixed in 6.2.8-tuxcare.1...
CLSA-2026-1785814923 TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 19 org.springframework.security packages to address 2 CVEs. Fixed in 6.2.7-tuxcare.1...
CLSA-2026-1785468079 TuxCare security update for swagger-ui (3 CVEs)
TuxCare rebuilt swagger-ui to address 3 CVEs. Fixed in 2.2.10-tuxcare.1...
CLSA-2026-1785468078 TuxCare security update for minimist (2 CVEs)
TuxCare rebuilt minimist to address 2 CVEs. Fixed in 0.0.9-tuxcare.1...
CLSA-2026-1785380885 TuxCare security update for storybook (2 CVEs)
TuxCare rebuilt storybook to address 2 CVEs. Fixed in 10.1.9-tuxcare.1...
CLSA-2026-1785814744 TuxCare security update for org.springframework (9 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 9 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.2...