https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:32:16 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09107 bdu:2026-09107 https://cve.radiocsirt.org/vuln/bdu:2026-09107 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0788 certfr-2026-avi-0788 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0788 https://cve.radiocsirt.org/vuln/cleanstart-2026-fr90298 <p><strong>Affected:</strong> CleanStart: azure-functions-node, CleanStart: jitsucom-jitsu</p> <p>CVE-2026-44289 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: azure-functions-node, CleanStart: jitsucom-jitsu</p> <p>CVE-2026-44289 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-fr90298 https://cve.radiocsirt.org/vuln/euvd-2026-361082 EUVD-2026-361082 https://cve.radiocsirt.org/vuln/euvd-2026-361082 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44289 <p>protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.</p> <p>protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44289 https://cve.radiocsirt.org/vuln/ghsa-685m-2w69-288q <p><strong>Affected:</strong> npm: protobufjs</p> <p>## Summary</p> <p>protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields.</p> <p>A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding.</p> <p>## Impact</p> <p>An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause decoding to fail with a stack overflow.</p> <p>This affects applications that decode untrusted protobuf binary input with affected versions.</p> <p>## Preconditions</p> <p>- The application must decode protobuf binary data influenced by an attacker. - The crafted input must contain deeply nested protobuf structures, such as nested group tags or nested message fields. - The affected decoder path must process the crafted input.</p> <p>## Workarounds</p> <p>Avoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.</p> <p><strong>Affected:</strong> npm: protobufjs</p> <p>## Summary</p> <p>protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields.</p> <p>A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding.</p> <p>## Impact</p> <p>An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause decoding to fail with a stack overflow.</p> <p>This affects applications that decode untrusted protobuf binary input with affected versions.</p> <p>## Preconditions</p> <p>- The application must decode protobuf binary data influenced by an attacker. - The crafted input must contain deeply nested protobuf structures, such as nested group tags or nested message fields. - The affected decoder path must process the crafted input.</p> <p>## Workarounds</p> <p>Avoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.</p> https://cve.radiocsirt.org/vuln/ghsa-685m-2w69-288q https://cve.radiocsirt.org/vuln/rhsa-2026:42815 <p>brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs: protobufjs: Denial of Service via crafted schema protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs: protobufjs: Denial of Service via crafted JSON descriptors linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution tar: node-tar: Denial of Service via crafted gzip bomb tar: Node-tar: Denial of Service via malformed tar archive header</p> <p>brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs: protobufjs: Denial of Service via crafted schema protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs: protobufjs: Denial of Service via crafted JSON descriptors linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution tar: node-tar: Denial of Service via crafted gzip bomb tar: Node-tar: Denial of Service via malformed tar archive header</p> https://cve.radiocsirt.org/vuln/rhsa-2026:42815 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2452 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2452