https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:34:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337537 EUVD-2026-337537 https://cve.radiocsirt.org/vuln/euvd-2026-337537 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12856 <p>A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.</p> <p>A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12856 https://cve.radiocsirt.org/vuln/ghsa-7vqr-7r5j-c84j <p>A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.</p> <p>A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.</p> https://cve.radiocsirt.org/vuln/ghsa-7vqr-7r5j-c84j https://cve.radiocsirt.org/vuln/rhsa-2026:36820 <p>undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames vscode-java: vscode: Command Injection vulnerability in the JavaDoc hover provider of the vscode-java extension github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of…</p> <p>undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames vscode-java: vscode: Command Injection vulnerability in the JavaDoc hover provider of the vscode-java extension github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:36820