https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:36:46 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09088 bdu:2026-09088 https://cve.radiocsirt.org/vuln/bdu:2026-09088 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0788 certfr-2026-avi-0788 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0788 https://cve.radiocsirt.org/vuln/cleanstart-2026-ed10498 <p><strong>Affected:</strong> CleanStart: azure-functions-node, CleanStart: jitsucom-jitsu</p> <p>CVE-2026-44290 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: azure-functions-node, CleanStart: jitsucom-jitsu</p> <p>CVE-2026-44290 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ed10498 https://cve.radiocsirt.org/vuln/euvd-2026-318499 EUVD-2026-318499 https://cve.radiocsirt.org/vuln/euvd-2026-318499 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44290 <p>protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.</p> <p>protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44290 https://cve.radiocsirt.org/vuln/ghsa-jvwf-75h9-cwgg <p><strong>Affected:</strong> npm: protobufjs</p> <p>## Summary</p> <p>protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality.</p> <p>## Impact</p> <p>An attacker who can provide or influence protobuf schemas or JSON descriptors may be able to corrupt built-in process state in a way that causes subsequent application code or protobufjs code to fail. This can result in a persistent denial of service for the lifetime of the affected process.</p> <p>This issue affects applications that parse or load protobuf schemas or descriptors from untrusted sources. Applications that use bundled, generated, or otherwise trusted schemas to decode untrusted protobuf message payloads are not directly affected.</p> <p>The issue is not known to allow code execution by itself.</p> <p>## Preconditions</p> <p>- The application must allow an attacker to control or influence a protobuf schema or JSON descriptor. - The application must parse or load that schema through protobufjs reflection APIs such as `parse`, `Root.load`, `Root.loadSync`, or `Root.fromJSON`. - The crafted input must contain option paths that reach unsafe inherited properties during option processing.</p> <p>## Workarounds</p> <p>Do not parse or load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or reject option na…</p> <p><strong>Affected:</strong> npm: protobufjs</p> <p>## Summary</p> <p>protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality.</p> <p>## Impact</p> <p>An attacker who can provide or influence protobuf schemas or JSON descriptors may be able to corrupt built-in process state in a way that causes subsequent application code or protobufjs code to fail. This can result in a persistent denial of service for the lifetime of the affected process.</p> <p>This issue affects applications that parse or load protobuf schemas or descriptors from untrusted sources. Applications that use bundled, generated, or otherwise trusted schemas to decode untrusted protobuf message payloads are not directly affected.</p> <p>The issue is not known to allow code execution by itself.</p> <p>## Preconditions</p> <p>- The application must allow an attacker to control or influence a protobuf schema or JSON descriptor. - The application must parse or load that schema through protobufjs reflection APIs such as `parse`, `Root.load`, `Root.loadSync`, or `Root.fromJSON`. - The crafted input must contain option paths that reach unsafe inherited properties during option processing.</p> <p>## Workarounds</p> <p>Do not parse or load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or reject option na…</p> https://cve.radiocsirt.org/vuln/ghsa-jvwf-75h9-cwgg https://cve.radiocsirt.org/vuln/rhsa-2026:42815 <p>brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs: protobufjs: Denial of Service via crafted schema protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs: protobufjs: Denial of Service via crafted JSON descriptors linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution tar: node-tar: Denial of Service via crafted gzip bomb tar: Node-tar: Denial of Service via malformed tar archive header</p> <p>brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs: protobufjs: Denial of Service via crafted schema protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs: protobufjs: Denial of Service via crafted JSON descriptors linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution tar: node-tar: Denial of Service via crafted gzip bomb tar: Node-tar: Denial of Service via malformed tar archive header</p> https://cve.radiocsirt.org/vuln/rhsa-2026:42815 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2452 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2452