CVE-2026-25641

SandboxJS has a TOCTOU-like sandbox escape vulnerability: before 0.8.29 there is a mismatch between the validation key and the key used for property access, allowing malicious objects to coerce string keys differently for validation and access. This can enable sandbox escape and potentially remot...

PT-2026-6658

Name of the Vulnerable Software and Affected Versions SandboxJS versions prior to 0.8.29 Description SandboxJS, a JavaScript sandboxing library, has a sandbox escape issue. This is due to a mismatch between the key used for validation and the key used for property access. The key, intended to be ...

PT-2025-42748

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow issue exists in the USB 9pfs transport layer. Inconsistent size validation between packet header parsing and actual data copying allows a malicious USB host to overflow...

PT-2026-24113

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.15.1 vLLM version 0.17.0 Description vLLM is an inference and serving engine for large language models LLMs. A Server-Side Request Forgery SSRF protection mechanism implemented in version 0.15.1 can be bypassed in the...

CVE-2025-4295 Host Header Injection in HotelRunner's B2B

Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B2B: before 04.06.2025...

CVE-2021-45456

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass...

HackerOne: Mismatch between frontend and backend validation via `ban_researcher` leads to H1 support and hackers email spam

Summary: We found a mismatch between the frontend and backend validation when using the ban researcher feature, available for program customer. Description: When a program customer issues a ban, an automatic email will be send both to the banned user and H1 support. The problem is that fronted wi...