https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:07:03.248350+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-pa44316 CLEANSTART-2026-PA44316 — Security fix for CVE-2026-48069 applied in: azure-functions-node 4.1052.200-r0 2026-10-03T08:07:03.332214+00:00

Affected: CleanStart: azure-functions-node

Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-337920 EUVD-2026-337920 2026-10-03T08:07:03.332271+00:00 EUVD-2026-337920 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48069 fkie_cve-2026-48069 2026-10-03T08:07:03.332287+00:00

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

 https://cve.radiocsirt.org/vuln/ghsa-99f4-grh7-6pcq GHSA-99f4-grh7-6pcq — @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash 2026-10-03T08:07:03.332311+00:00

Affected: npm: @grpc/grpc-js

### Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js

### Patches The following version have fixes for this vulnerability:

- 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4

### Workarounds There is no workaround.

 https://cve.radiocsirt.org/vuln/rhsa-2026:48126 RHSA-2026:48126 — Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release. 2026-10-03T08:07:03.332337+00:00

multer: Multer: Denial of Service via aborted or malformed multipart uploads multer: Multer: Denial of Service via deeply nested field names in multipart form data brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via crafted JSON descriptors js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution js-yaml: js-yaml: Denial of Service via crafted YAML documents protobufjs: protobufjs: Denial of Service via crafted .proto schema