Most recent entries from all

bdu:2026-09109

2026-10-02T14:21:15.851405+00:00

bdu:2026-09109

certfr-2026-avi-0788 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

2026-10-02T14:21:15.851476+00:00

certfr-2026-avi-0788

Withdrawn: CLEANSTART-2026-RZ36238 — Security fixes in azure-functions-node 4.1052.200-r0

2026-10-02T14:21:15.851501+00:00

Withdrawn by the publisher.

Affected: CleanStart: azure-functions-node

Package azure-functions-node version 4.1052.200-r0 fixes 22 vulnerabilities: CVE-2026-41907, CVE-2026-48068, CVE-2026-48069, CVE-2024-37168, CVE-2024-4068...

EUVD-2026-365497

2026-10-02T14:21:15.851534+00:00

EUVD-2026-365497

fkie_cve-2026-44293

2026-10-02T14:21:15.851547+00:00

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

GHSA-66ff-xgx4-vchm — protobuf.js: Code injection through bytes field defaults in generated toObject code

2026-10-02T14:21:15.851570+00:00

Affected: npm: protobufjs

## Summary

protobufjs generated JavaScript for `toObject` conversion could include an unsafe expression derived from a schema-controlled `bytes` field default value. A crafted descriptor with a non-string default value for a `bytes` field could cause attacker-controlled code to be emitted into the generated conversion function.

## Impact

An attacker who can provide or influence a protobuf descriptor may be able to execute arbitrary JavaScript in the context of the process using protobufjs.

This requires the application to load an attacker-controlled schema or descriptor and then convert a message of the affected type with defaults enabled. Applications that only use trusted, application-defined schemas are not directly affected by this issue.

## Preconditions

- The application must allow an attacker to control or influence a protobuf JSON descriptor or equivalent reflected schema. - The descriptor must define a `bytes` field with an attacker-controlled default value. - The application must call `toObject` with defaults enabled for the affected type.

## Workarounds

Do not load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict field options before loading them and run schema processing in an isolated environment.

RHSA-2026:26090 — Red Hat Security Advisory: Kiali 2.22.5 for Red Hat OpenShift Service Mesh 3.3

2026-10-02T14:21:15.851605+00:00

shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors