net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

EUVD-2026-70227

A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in...

CVE-2026-84833 ntegrals openbrowser Browser Agent Message Construction agent.ts resource consumption

A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in...

CVE-2026-84833 ntegrals openbrowser Browser Agent Message Construction agent.ts resource consumption

A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in...

CVE-2026-84833

ntegrals openbrowser is vulnerable to a resource consumption flaw in the Browser Agent Message Construction component, specifically within the file packages/core/src/agent/agent.ts. The vulnerability allows a remote attacker to trigger resource exhaustion by manipulating the affected functionalit...

CVE-2026-84809 Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

EUVD-2026-70224

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

CVE-2026-84809 Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

CVE-2026-84809

Tencent AI-Infra-Guard 's skill-scan component (affected in v4.6.0) hardcodes __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. An attacker can distribute a skill containing benign Python source files alongside malicious compiled bytecode tha...

CVE-2026-84809 Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

Overview On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution RCE ...

CVE-2026-66362

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...

K000163169: BIND vulnerability CVE-2026-12617

Security Advisory Description The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server...

cve-2026-33067

CVE-2026-33017 — Langflow 未认证 RCE Nuclei 模板 用于检测 CVE-2026-33017 的 Nuclei 模板——这是 Langflow ≤ 1.8.2 中存在的一个未认证远程代码执行漏洞，可通过公共 flow 构建端点访问： root@kitploit: POST /api/v1/buildpublictmp/flowid/flow 存在漏洞的处理程序接受攻击者控制的 data 流程（flow）图，并在图构建期间将 data.nodes.data.node.template.code.value 直接传入 Python...

GHSA-FPH4-WMHF-6FWF fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Impact fast-uri decodes a hostname's percent escapes twice in a single normalize or resolve call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so...

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Impact fast-uri decodes a hostname's percent escapes twice in a single normalize or resolve call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so...

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

Impact fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore...

GHSA-JQFF-G426-HQXP fast-uri vulnerable to host confusion via percent-encoded scheme normalization

Impact fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore...