fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its…

▾ Twilightopenjsf · fast-uriEPSS 0.48%via NVD

CVE-2026-44840High· 7.5PoC

3mo ago

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

▾ Midnightdgraph-io · github.com/dgraph-io/dgraph/v25EPSS 0.49%via GHSA

GHSA-fr4h-3cph-29xvHigh· 7.1

3mo ago

pnpm: Hoisted install imports lockfile alias outside node_modules

▾ Twilightpnpm · pnpmvia GHSA

GHSA-72r4-9c5j-mj57High· 7.1

3mo ago

pnpm: `patch-remove` could delete project-selected files outside the patches directory

▾ Twilightpnpm · pnpmvia GHSA

GHSA-qrv3-253h-g69cHigh· 8.2

3mo ago

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

▾ Twilightpnpm · pnpmvia GHSA

CVE-2026-55677High· 7.5

3mo ago

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encod…

▾ TwilightRed Hat · Red Hat Enterprise Linux AppStream E4S (v.9.2)EPSS 0.43%via CSAF

CVE-2026-47077High

3mo ago

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

▾ Twilighthackney · hackneyEPSS 0.70%via GHSA

CVE-2026-53463Medium· 4.3

3mo ago

ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments

▾ SunlitMagick · Magick.NET-Q16-AnyCPUEPSS 0.32%via GHSA

CVE-2026-48758Medium· 5.4

3mo ago

@sigstore/core has DSSE payloadType type-binding failure

▾ Sunlitsigstore · @sigstore/coreEPSS 0.26%via GHSA

CVE-2026-48782Medium· 6.8

3mo ago

pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

▾ Sunlitpydantic-ai-slim · pydantic-ai-slimEPSS 0.42%via GHSA

CVE-2026-48788High· 8.2

3mo ago

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

▾ Twilightumputun · github.com/umputun/remark42EPSS 0.41%via GHSA

GHSA-5vwr-qchf-q4pfMedium

3mo ago

@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths

▾ Sunlitcyclonedx · @cyclonedx/cdxgenvia GHSA

Tagged “ghsa”

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

oban_web: Unbounded range expansion in cron describe causes memory exhaustion

oban_web missing authorization check on `save-job` event handler

@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality

Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString

Open Babel has NULL pointer dereference in MOL2 OBAtom::SetFormalCharge

Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence

Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule

Paymenter has race condition in payWithCredit() that enables credit double-spend

Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API

Paymenter has URL parameter injection that bypasses paid plan limits at checkout

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

pnpm: Hoisted install imports lockfile alias outside node_modules

pnpm: `patch-remove` could delete project-selected files outside the patches directory

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments

@sigstore/core has DSSE payloadType type-binding failure

pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths