CVE-2026-62909

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...

PT-2026-70596

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description An uncaught exception in .NET allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no information about a newer version that contains a fix for th...

CVE-2026-47364

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-47364

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-47364

The Datadog Android application prior to version v545-5.9.2 is vulnerable to the exposure of sensitive information. The application tags Crashlytics data with the user's Datadog UUID without providing a user-facing opt-out mechanism. Consequently, both the user UUID and the crash data are visible...

CVE-2026-71559: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users o...

CVE-2026-71430

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...

📄 Let's Chat 0.4.8 Denial of Service

Let's Chat versions 0.4.8 and earlier contain a denial of service vulnerability in the message lookup functionality. An authenticated attacker can supply a valid but nonexistent room identifier, triggering an uncaught exception that terminates the Node.js server process. Security Advisory:...

PT-2026-65519

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

USN-8614-1 python2.7, python3.5 vulnerabilities

It was discovered that Python incorrectly handled expanding environment variables in os.path.expandvars when the input was user-controlled. An attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. CVE-2025-6075 It was discovered that Python...

Uncaught Exception

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Uncaught Exception via the form function when processing large remote payloads. An attacker can cause the Node process to crash by repeatedly submitting oversized payloads. Remediation...

GHSA-45RX-2JWX-CXFR OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

Summary @opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent without handling decode errors. A single request carrying a malformed percent-encoded value for example a bare % in an uber-trace-id or uberctx- header throws an uncaught URIError, terminating any...

GHSA-2X63-GW47-W4MM websocket-driver-ruby: Denial of service via malformed Host header

Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...

GHSA-GVWX-54WH-QM9J node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

Summary node-tar strips trailing NUL bytes from long-name L and long-linkpath K GNU extended headers but does not apply the same sanitization to equivalent fields delivered via PAX x typeflag extended headers. A PAX record of the form path=visible.txt\x00hidden.txt is parsed verbatim into...

EUVD-2026-42303

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records...

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

Summary node-tar strips trailing NUL bytes from long-name L and long-linkpath K GNU extended headers but does not apply the same sanitization to equivalent fields delivered via PAX x typeflag extended headers. A PAX record of the form path=visible.txt\x00hidden.txt is parsed verbatim into...

GHSA-F7Q6-7RQ9-3PHX Duplicate Advisory: Uncaught Exception processing HTTP Headers in SurrealDB

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m24x-r6q3-2vp9. This link is maintained to preserve external references. Original Description SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containin...

Duplicate Advisory: Uncaught Exception processing HTTP Headers in SurrealDB

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m24x-r6q3-2vp9. This link is maintained to preserve external references. Original Description SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containin...

GHSA-9QRF-6WHP-92W3 Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jc55-246c-r88f. This link is maintained to preserve external references. Original Description SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged...

Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jc55-246c-r88f. This link is maintained to preserve external references. Original Description SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged...