VulnSea

developer_hub vulnerabilities

CVEs whose affected-version data names the developer_hub package (go, npm, pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

46 CVEsRSS

CVE-2026-6734High· 7.5
3mo ago

undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

A flaw was found in undici. When using Socks5ProxyAgent, undici incorrectly reuses a single connection pool across different origins. This can lead to cross-origin request routing, where sensitive credentials and data intended for one dest…

TwilightRed Hat · Red Hat Openshift Data Foundation 4.20EPSS 0.34%via CSAF
CVE-2026-12151High· 7.5
3mo ago

undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client …

TwilightRed Hat · Red Hat Openshift Data Foundation 4.20EPSS 0.79%via CSAF
CVE-2026-9697High· 7.4
3mo ago

undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

A flaw was found in undici. When undici's ProxyAgent is configured with a SOCKS5 proxy Uniform Resource Identifier (URI), it silently ignores Transport Layer Security (TLS) options, such as custom Certificate Authorities (CAs). This allows…

TwilightRed Hat · Red Hat Openshift Data Foundation 4.20EPSS 0.46%via CSAF
CVE-2026-5038High· 7.5⚖ disputed
3mo ago

multer: Multer: Denial of Service via aborted or malformed multipart uploads (CVE-2026-5038)

A flaw was found in multer. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by initiating and then aborting or sending malformed multipart uploads. This action leaves orphaned partial files on the disk, whi…

TwilightRed Hat · Red Hat Enterprise Linux 10EPSS 0.28%via CSAF
CVE-2026-5079High· 7.5
3mo ago

multer: Multer: Denial of Service via deeply nested field names in multipart form data (CVE-2026-5079)

A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object stru…

TwilightRed Hat · Red Hat Enterprise Linux 10EPSS 0.28%via CSAF
CVE-2026-44495High· 7.0PoC
3mo ago

Axios is a promise based HTTP client for the browser and Node.js

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process h…

Midnightaxios · axiosEPSS 0.85%via NVD
CVE-2026-45409Medium· 5.3
3mo ago

python-idna: idna: Denial of Service via specially crafted long inputs (CVE-2026-45409)

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding f…

SunlitRed Hat · Red Hat Enterprise Linux 9EPSS 0.41%via CSAF
CVE-2026-44740High· 7.5
3mo ago

github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)

A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation an…

TwilightRed Hat · Red Hat Openshift Data Foundation 4.22EPSS 0.39%via CSAF
CVE-2026-44724High· 7.8
3mo ago

systeminformation is a System and OS information library for node.js

systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name cont…

TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.78%via NVD
CVE-2026-44431Medium· 5.3
4mo ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive hea…

SunlitRed Hat · Red Hat Enterprise Linux AppStream (v. 8)EPSS 0.33%via NVD
CVE-2026-39823Medium· 5.4
4mo ago

html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)

A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL's content attribute inside a `<meta>` tag. This improper esc…

SunlitRed Hat · Red Hat OpenShift Container Platform 4EPSS 0.31%via CSAF
CVE-2026-39826Medium· 5.4
4mo ago

html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block,…

SunlitRed Hat · Red Hat OpenShift Container Platform 4EPSS 0.37%via CSAF
CVE-2026-39825Medium· 6.5
4mo ago

net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2…

A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs becaus…

SunlitRed Hat · Red Hat OpenShift Container Platform 4.22EPSS 0.39%via CSAF
CVE-2026-6357Medium· 5.8
4mo ago

pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation (CVE-2026-6357)

A flaw was found in pip. Prior to version 26.1, pip's self-update check functionality would execute after installing wheel packages. This process involved importing newly installed Python modules. A malicious actor could craft a specially …

SunlitRed Hat · Red Hat OpenShift AI (RHOAI)EPSS 0.14%via CSAF
CVE-2026-32289Medium· 5.4
5mo ago

html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals (CVE…

A flaw was found in the `html/template` package. This vulnerability arises from improper tracking of context and brace depth within JavaScript (JS) template literals. A remote attacker could exploit these issues to cause content to be inco…

SunlitRed Hat · Red Hat OpenShift Container Platform 4EPSS 0.29%via CSAF
CVE-2025-58188Medium
10mo ago

crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 (CVE-2025-58188)

A denial of service vector has been discovered in the golang crypto/x509 module. An attacker could craft an intermediate X.509 certificate containing a DSA public key and can crash a remote host with an unauthenticated call to any endpoint…

SunlitRed Hat · Red Hat OpenShift Container Platform 4EPSS 0.36%via CSAF
developer_hub vulnerabilities (CVEs) — page 2 · VulnSea