https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 00:32:19 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/cleanstart-2026-gj99967 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: npm</p> <p>Package npm version 11.14.0-r3 fixes 2 vulnerabilities: CVE-2026-53655, CVE-2026-9358</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: npm</p> <p>Package npm version 11.14.0-r3 fixes 2 vulnerabilities: CVE-2026-53655, CVE-2026-9358</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-gj99967 https://cve.radiocsirt.org/vuln/euvd-2026-327219 EUVD-2026-327219 https://cve.radiocsirt.org/vuln/euvd-2026-327219 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9358 <p>A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.1.3 and 7.1.3 is able to address this issue. This patch is called 5bc698cef66f8abd12610dc623e5d67cbc0f869d. It is suggested to upgrade the affected component. The vendor explains, that according to his definition &#34;DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).&#34; The commits were backported to 6.x branch, which was the most downloaded version.</p> <p>A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.1.3 and 7.1.3 is able to address this issue. This patch is called 5bc698cef66f8abd12610dc623e5d67cbc0f869d. It is suggested to upgrade the affected component. The vendor explains, that according to his definition &#34;DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).&#34; The commits were backported to 6.x branch, which was the most downloaded version.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9358 https://cve.radiocsirt.org/vuln/ghsa-w9m9-85wc-3x92 <p><strong>Affected:</strong> npm: postcss-selector-parser</p> <p>A vulnerability was determined in postcss-selector-parser before 6.1.3 and 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition &#34;DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).&#34;</p> <p><strong>Affected:</strong> npm: postcss-selector-parser</p> <p>A vulnerability was determined in postcss-selector-parser before 6.1.3 and 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition &#34;DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).&#34;</p> https://cve.radiocsirt.org/vuln/ghsa-w9m9-85wc-3x92 https://cve.radiocsirt.org/vuln/rhsa-2026:22934 <p>undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization undici: undici WebSocket client vulnerable to denial of service via cumulative fragment bypass undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy urllib3: urllib3: Denial of Service due to excessive HTTP response decompression brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges</p> <p>undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization undici: undici WebSocket client vulnerable to denial of service via cumulative fragment bypass undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy urllib3: urllib3: Denial of Service due to excessive HTTP response decompression brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges</p> https://cve.radiocsirt.org/vuln/rhsa-2026:22934 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9358 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-css-loader, Ubuntu:22.04:LTS: node-css-loader, Ubuntu:24.04:LTS: node-css-loader, Ubuntu:25.10: node-css-loader, Ubuntu:26.04:LTS: node-css-loader</p> <p>A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.1.3 and 7.1.3 is able to address this issue. This patch is called 5bc698cef66f8abd12610dc623e5d67cbc0f869d. It is suggested to upgrade the affected component. The vendor explains, that according to his definition &#34;DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).&#34; The commits were backported to 6.x branch, which was the most downloaded version.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-css-loader, Ubuntu:22.04:LTS: node-css-loader, Ubuntu:24.04:LTS: node-css-loader, Ubuntu:25.10: node-css-loader, Ubuntu:26.04:LTS: node-css-loader</p> <p>A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.1.3 and 7.1.3 is able to address this issue. This patch is called 5bc698cef66f8abd12610dc623e5d67cbc0f869d. It is suggested to upgrade the affected component. The vendor explains, that according to his definition &#34;DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).&#34; The commits were backported to 6.x branch, which was the most downloaded version.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9358