1715 matches found
NPM: Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
NPM: Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats normalizeStats vulnerability discovered by ? in WordPress Npm browserslist versions = 4.28.6...
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
Vulnerability Details File: node.js Function: normalizeStats line 214, reached from getStat called unconditionally on every browserslist call and loadStat Root Cause js function normalizeStatsdata, stats if !data data = if stats && 'dataByBrowser' in stats stats = stats.dataByBrowser if typeof...
PT-2026-84387
Uncaught Exception CWE-248 in Kibana can lead to a denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error...
Important: dotnet10.0
Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized...
Important: dotnet8.0
Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized...
Important: dotnet9.0
Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized...
Uncaught Exception
Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer function in lib/utils.js, which calls obj.constructor.isBufferobj without checking that it is callable,...
Uncaught Exception
Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer function in lib/utils.js, which calls obj.constructor.isBufferobj without checking that it is callable, reached from...
Uncaught Exception
Overview Affected versions of this package are vulnerable to Uncaught Exception via the appendField call in make-middleware.js when processing multipart form field names. An attacker submitting a malformed or invalid field name in a multipart upload request causes an unhandled exception that...
Uncaught Exception
Overview Affected versions of this package are vulnerable to Uncaught Exception via the appendField call in make-middleware.js when processing multipart form field names. An attacker submitting a malformed or invalid field name in a multipart upload request causes an unhandled exception that...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS via the appendField call in make-middleware.js when processing multipart form field names. An attacker can send a request containing an invalid field name that causes appendField to throw an uncaught exception,...
CVE-2026-77078
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...
CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...
CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...
PT-2026-83358
Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0 Description A denial of service issue exists in the middleware used for handling multipart/form-data in Node.js. A specially crafted multipart request containing two text field names can trigger an uncaught...
Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 1.0.2.0. Vulnerability Details CVEID:CVE-2024-28835 DESCRIPTION: A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using...
CVE-2026-55619 eml_parser: Parser DoS via deeply nested parentheses in e-mail headers
emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.parser.HeaderParser.headerfetchparse in emlparser/parser.py uses email.utils.getaddresses to parse address-bearing e-mail...
Denial Of Service (DoS)
Phoenix is vulnerable to Denial-of-Service DoS. The vulnerability is due to an unsafe truthiness check for attacker-controlled presence keys that can reference JavaScript Object.prototype properties, which allows an attacker to trigger uncaught exceptions and cause persistent client-side denial o...
PT-2026-81475
Name of the Vulnerable Software and Affected Versions eml parser versions prior to 3.0.2 Description The header fetch parse function within the eml parser.parser.HeaderParser module uses email.utils.getaddresses to parse address-bearing e-mail headers. A deeply nested CFWS Comments and Folding...
