Most recent entries from all

EUVD-2026-357984

2026-10-03T15:05:20.534137+00:00

EUVD-2026-357984

fkie_cve-2026-42570

2026-10-03T15:05:20.534180+00:00

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.

GHSA-77vg-94rm-hx3p — Svelte devalue: DoS via sparse array deserialization

2026-10-03T15:05:20.534218+00:00

Affected: npm: devalue

`devalue.parse` could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.

RHSA-2026:37272 — Red Hat Security Advisory: RHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release

2026-10-03T15:05:20.534244+00:00

image-size: image-size: Denial of Service due to infinite loop when processing specially crafted images. golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API devalue: devalue: Excessive memory consumption via deserialization of sparse arrays next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n Next.js: Next.js: Authorization bypass via crafted query parameters next.js: Next.js: Unauthorized access to protected content via middleware bypass Next.js: Next.js: Denial of Service via Image Optimization API Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests next.js: Next.js: Denial of Service via crafted POST requests to server actions next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments