EUVD-2026-48310

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

CVE-2026-44909

CVE-2026-44909 – Normal mode Proxygen’s HTTP/2 flow-control handling in the core HTTP session layer lacks a generalized slow-consumer detection mechanism. A remote unauthenticated attacker can exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or by withholding WINDOW_UPDATE...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

CVE-2026-15614

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

Improper Check for Unusual or Exceptional Conditions

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the INPLACE process when DOM elements are passed from a different window or realm, such as an iframe's...

CVE-2026-65904 DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

EUVD-2026-48273

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

CVE-2026-13065

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

CVE-2026-13065 MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

Impact The Resource Locator passes the workflow-persisted cachedResultUrl to window.open without scheme validation. When a victim opens the crafted workflow and interact with external links, the JavaScript payload runs in the victim's browser. Patches The issue has been fixed in n8n versions...

GHSA-9WCP-9R3J-383Q n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

Impact The Resource Locator passes the workflow-persisted cachedResultUrl to window.open without scheme validation. When a victim opens the crafted workflow and interact with external links, the JavaScript payload runs in the victim's browser. Patches The issue has been fixed in n8n versions...

Security update for ImageMagick

This update for ImageMagick fixes the following issues CVE-2026-56375: possible memory leak in ASHLAR coder when action fails bsc1271495. CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title bsc1271496. CVE-2026-61859: policy bypass in script operation due to missing chec...

CVE-2026-42955 Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other...

CVE-2026-65592

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

EUVD-2026-47636

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

PT-2026-63350

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

CVE-2026-63867

A flaw was found in the Linux kernel's Multipath TCP MPTCP implementation. A race condition exists when computing the receive window, where the acknowledgment sequence number is accessed without proper locking. This can lead to inconsistencies in how the receive window is calculated and...

CVE-2026-64825 Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field...

CVE-2026-64825

CVE-2026-64825 : Home Assistant Core prior to 2026.6.0 contains a path traversal vulnerability reachable during initial onboarding via a crafted backup archive. By manipulating the name field inside the archive’s backup.json to supply an absolute path, the code path using pathlib.Path.truediv dis...