https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:00:48 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-pa44316 <p><strong>Affected:</strong> CleanStart: azure-functions-node</p> <p>Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: azure-functions-node</p> <p>Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-pa44316 https://cve.radiocsirt.org/vuln/euvd-2026-337920 EUVD-2026-337920 https://cve.radiocsirt.org/vuln/euvd-2026-337920 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48069 <p>@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.</p> <p>@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48069 https://cve.radiocsirt.org/vuln/ghsa-99f4-grh7-6pcq <p><strong>Affected:</strong> npm: @grpc/grpc-js</p> <p>### Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js</p> <p>### Patches The following version have fixes for this vulnerability:</p> <p>- 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4</p> <p>### Workarounds There is no workaround.</p> <p><strong>Affected:</strong> npm: @grpc/grpc-js</p> <p>### Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js</p> <p>### Patches The following version have fixes for this vulnerability:</p> <p>- 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4</p> <p>### Workarounds There is no workaround.</p> https://cve.radiocsirt.org/vuln/ghsa-99f4-grh7-6pcq https://cve.radiocsirt.org/vuln/rhsa-2026:48126 <p>multer: Multer: Denial of Service via aborted or malformed multipart uploads multer: Multer: Denial of Service via deeply nested field names in multipart form data brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via crafted JSON descriptors js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution js-yaml: js-yaml: Denial of Service via crafted YAML documents protobufjs: protobufjs: Denial of Service via crafted .proto schema</p> <p>multer: Multer: Denial of Service via aborted or malformed multipart uploads multer: Multer: Denial of Service via deeply nested field names in multipart form data brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via crafted JSON descriptors js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution js-yaml: js-yaml: Denial of Service via crafted YAML documents protobufjs: protobufjs: Denial of Service via crafted .proto schema</p> https://cve.radiocsirt.org/vuln/rhsa-2026:48126