https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:05:55.412628+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 certfr-2026-avi-1094 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T22:05:55.561119+00:00 certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/euvd-2026-331341 EUVD-2026-331341 2026-10-02T22:05:55.561193+00:00 EUVD-2026-331341 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45822 fkie_cve-2026-45822 2026-10-02T22:05:55.561217+00:00

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

 https://cve.radiocsirt.org/vuln/ghsa-vcc3-ghjq-m6fr GHSA-vcc3-ghjq-m6fr — decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input 2026-10-02T22:05:55.561263+00:00

Affected: npm: decode-uri-component

### Impact An attacker who can supply input to `decodeUriComponent()` (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.

### Patches Upgrade to `decode-uri-component@0.5.0`.

### Workarounds Limit the size of the input.

 https://cve.radiocsirt.org/vuln/rhsa-2026:40262 RHSA-2026:40262 — Red Hat Security Advisory: Red Hat Quay 3.9.24 2026-10-02T22:05:55.561305+00:00

form-data: form-data: Form field override via CRLF injection fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint net/mail: golang: net/mail: Denial of Service via pathological email address parsing golang.org/x/crypto/ssh/knownhosts: golang: golang…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45822 UBUNTU-CVE-2026-45822 2026-10-02T22:05:55.561409+00:00

Affected: Ubuntu:22.04:LTS: node-source-map-resolve, Ubuntu:24.04:LTS: node-source-map-resolve, Ubuntu:25.10: node-source-map-resolve, Ubuntu:26.04:LTS: node-source-map-resolve

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.