https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:38:28 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09089 bdu:2026-09089 https://cve.radiocsirt.org/vuln/bdu:2026-09089 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0788 certfr-2026-avi-0788 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0788 https://cve.radiocsirt.org/vuln/cleanstart-2026-or18491 <p><strong>Affected:</strong> CleanStart: azure-functions-node, CleanStart: jitsucom-jitsu</p> <p>CVE-2026-44291 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: azure-functions-node, CleanStart: jitsucom-jitsu</p> <p>CVE-2026-44291 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-or18491 https://cve.radiocsirt.org/vuln/euvd-2026-318079 EUVD-2026-318079 https://cve.radiocsirt.org/vuln/euvd-2026-318079 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44291 <p>protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.</p> <p>protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44291 https://cve.radiocsirt.org/vuln/ghsa-75px-5xx7-5xc7 <p><strong>Affected:</strong> npm: protobufjs</p> <p>## Summary</p> <p>protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If `Object.prototype` had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information.</p> <p>This could cause attacker-controlled strings to be emitted into generated JavaScript code.</p> <p>## Impact</p> <p>An attacker who can first trigger a prototype pollution vulnerability may be able to influence generated protobufjs encode or decode functions in a way that can lead to arbitrary JavaScript execution.</p> <p>This issue requires a separate prototype pollution primitive before protobufjs is invoked.</p> <p>Applications without a reachable prototype pollution primitive are not directly exploitable through this issue alone.</p> <p>## Preconditions</p> <p>- The application or one of its dependencies must allow an attacker to pollute `Object.prototype`. - The polluted property must affect protobufjs internal type lookup behavior. - The application must use protobufjs functionality that generates encode or decode code for affected types. - The generated code path must be reached after the prototype pollution has occurred.</p> <p>## Workarounds</p> <p>Avoid running affected versions in applications where attacker-controlled input can pollute `Object.prototype`. If immediate upgrade is not possible, remove or mitigate reachable prototype pollution primitives and isolate schema/message processing from untrusted appli…</p> <p><strong>Affected:</strong> npm: protobufjs</p> <p>## Summary</p> <p>protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If `Object.prototype` had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information.</p> <p>This could cause attacker-controlled strings to be emitted into generated JavaScript code.</p> <p>## Impact</p> <p>An attacker who can first trigger a prototype pollution vulnerability may be able to influence generated protobufjs encode or decode functions in a way that can lead to arbitrary JavaScript execution.</p> <p>This issue requires a separate prototype pollution primitive before protobufjs is invoked.</p> <p>Applications without a reachable prototype pollution primitive are not directly exploitable through this issue alone.</p> <p>## Preconditions</p> <p>- The application or one of its dependencies must allow an attacker to pollute `Object.prototype`. - The polluted property must affect protobufjs internal type lookup behavior. - The application must use protobufjs functionality that generates encode or decode code for affected types. - The generated code path must be reached after the prototype pollution has occurred.</p> <p>## Workarounds</p> <p>Avoid running affected versions in applications where attacker-controlled input can pollute `Object.prototype`. If immediate upgrade is not possible, remove or mitigate reachable prototype pollution primitives and isolate schema/message processing from untrusted appli…</p> https://cve.radiocsirt.org/vuln/ghsa-75px-5xx7-5xc7 https://cve.radiocsirt.org/vuln/rhsa-2026:42815 <p>brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs: protobufjs: Denial of Service via crafted schema protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs: protobufjs: Denial of Service via crafted JSON descriptors linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution tar: node-tar: Denial of Service via crafted gzip bomb tar: Node-tar: Denial of Service via malformed tar archive header</p> <p>brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs: protobufjs: Denial of Service via crafted schema protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs: protobufjs: Denial of Service via crafted JSON descriptors linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution tar: node-tar: Denial of Service via crafted gzip bomb tar: Node-tar: Denial of Service via malformed tar archive header</p> https://cve.radiocsirt.org/vuln/rhsa-2026:42815 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2452 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2452