Author name: UNDERCODE

The fast-jwt library contains a critical security flaw in its token verification option processing where passing an infinite value for

CVE-2020-15778 is a critical command injection vulnerability discovered in the secure copy (scp) client implementation across OpenSSH versions up to

The vulnerability identified in Indico’s legacy session export API stems from an insufficient authorization and broken access control mechanism when

CVE-2026-56852 is a critical vulnerability residing within the text processing library for Go, specifically inside the normalization package component known

The fix for CVE-2026-34950 in `fast-jwt` introduced an incomplete mitigation by utilizing key.trim(), which only strips standard ECMAScript whitespace characters.

A Cross-Site Scripting (XSS) vulnerability exists within fields that accept custom URLs inside the Indico event management platform. This security

The vulnerability resides within the shared `createURL()` helper utilized by AdonisJS route URL builders, including `Router.makeUrl()` and Response.redirect().toRoute(). Specifically, route

CVE-2026-107720 represents a critical authentication and authorization bypass vulnerability residing in the popular fast-jwt library for Node.js up to version

The vulnerability identified in the tcpcat repository under version 1.1.0 highlights a critical security oversight involving the advanced scripting subsystem

Cross-Site-Scripting (XSS) represents a widespread web application vulnerability where malicious scripts are injected into trusted websites, subsequently executing inside a

The vulnerability in PraisonAI stems from an unauthenticated MCP HTTP-stream server design where security controls are entirely opt-in. Specifically, when

PraisonAI Platform contains an authorization flaw where ordinary workspace members can modify owner-created project, issue, and agent records through unchecked

The Mechanize Ruby library contains multiple logic flaws in its HTTP redirect and header management implementation within lib/mechanize/http/agent.rb. Specifically, Mechanizerequest_headers=

SecurityPolicy in praisonaiagents/sandbox/config.py is a configuration data class defining rules such as allow_subprocess, allowed_paths, blocked_paths, allowed_commands, blocked_commands, allowed_imports, and blocked_imports.

The vulnerability resides within the Ruby Mechanize library, specifically inside the HTTP agent component responsible for handling automated web browsing

The Handlebars templating library contains a vulnerability in how its property lookup mechanism handles prototype properties. Specifically, the `lookupProperty` function

The security advisory CVE-2026-106119 details a critical logic flaw in the LangChain.js MongoDB integration package. The vulnerability specifically targets the

The vulnerability resides within the StsdAtom.get() function inside lib/mp4/AtomToken.ts of the music-metadata package, where an MP4 sample description (stsd) box’s

On the zero-configuration TLS path, the MariaDB Node.js connector accepts a self-signed server certificate at the TLS level and subsequently

DailyCVE Form: Platform: enshrined/svg-sanitize Version: < 1.0.0 Vulnerability : Stored XSS Severity: Medium date: 2026-10-08 Prediction: 2026-10-15 What Undercode Say

A crafted Scalable Vector Graphics file containing an inline Document Type Definition with a fixed attribute default crashes the underlying

CVE-2026-107388 represents a critical design flaw in the music-metadata library where the ID3v2 parser blindly trusts the tag size header

This vulnerability exists within the GeoJSON binary protocol encoding mechanism for Polygon and MultiPolygon geometries in the database connector. When

The vulnerability resides in PraisonAI’s API deployment generator, specifically within src/praisonai/praisonai/deploy/api.py, where configuration values parsed from YAML files are unsafely

When processing an attacker-controlled Protobuf schema, vulnerable library versions fail to sanitize import paths. The vulnerability resides in how the

CVE-2021-36942, widely known as PetitPotam, is a critical Local Security Authority (LSA) spoofing vulnerability affecting Microsoft Windows operating systems. The

The CVE-2026-107387 vulnerability affects the music-metadata library prior to version 11.16.0, specifically residing within its APEv2 parser implementation across `APEv2Token.ts`

The vulnerability resides within the Matroska/WebM EBML parser component of the library, which decodes variable-length integer (VINT) element lengths derived

Handlebars provides powerful functionality for building semantic templates via precompilation. The vulnerability stems from how static template text is handled

The vulnerability stems from a flaw in how text-protocol string and binary parameter escaping is handled within the MariaDB database

The CVE-2026-107392 vulnerability in music-metadata stems from an un-awaited asynchronous method call within the DSF parser’s main chunk iteration loop.

Dark Threat Radar v1.9.3 introduces critical security hardening addressing stored and DOM-based Cross-Site Scripting vulnerabilities. Stored XSS occurs when user-supplied

CVE-2025-55315 represents a critical HTTP request smuggling vulnerability residing within the Kestrel web server component of ASP.NET Core. The flaw

MariaDB Connector/Node.js contains a vulnerability related to SQL injection during SET clause expansion when the non-default permitSetMultiParamEntries option is enabled.

The vulnerability stems from a case-sensitive mismatch during reference graph collection versus subsequent attribute normalization in the SVG sanitization library.

The amqp091-go library contains a critical state-boundary flaw where pre-negotiation frame-size mitigation can be bypassed during connection setup. Specifically, a

PraisonAI includes a context-gathering utility designed to bundle repository files for user reference or model ingestion. Specifically, the `ContextGatherer` component

PraisonAI implements an agent invocation API through FastAPI, protected by a token verification dependency named verify_token(). When the environment variable

Handlebars.compile() and Handlebars.precompile() accept a pre-parsed Abstract Syntax Tree (AST) alongside standard template strings. Although version 4.7.9 introduced validation logic

The vulnerability resides within CairoSVG’s path rendering engine, specifically inside the `cairosvg/path.py` module where untrusted SVG path data is parsed

CVE-2021-3199 represents a critical path traversal vulnerability discovered within the ONLYOFFICE Document Server application. Specifically, this security flaw manifests inside

CVE-2026-85706 is a critical path traversal vulnerability in GitLab CE and EE repository commits and files endpoints. It stems from

CVE-2026-82329 is a critical improper authentication vulnerability affecting JFrog Artifactory and its credential management component, JFrog Access. The vulnerability stems

CVE-2016-3081 is a critical security vulnerability affecting Apache Struts. It specifically targets applications where Dynamic Method Invocation is enabled. The

CVE-2023-22893 is a critical information disclosure vulnerability affecting Strapi versions up to 4.5.5. The vulnerability stems from an insecure implementation

The vulnerability identified as CVE-2015-3306 exists within the mod_copy module of ProFTPD version 1.3.5. This specific module implements the SITE

CVE-2015-5477 affects the ISC BIND DNS server software. The flaw resides specifically in the `named` daemon component. It impacts BIND

The AsyncHttpClient (AHC) library contains an implementation flaw in its default-enabled cookie management store where explicitly provided request headers can

The vulnerability exists within the AsyncHttpClient library where the client nonce (cnonce) utilized during HTTP Digest authentication is generated using

The vulnerability identified under CVE-2026-107230 represents an incomplete fix for a prior connection pooling flaw (GHSA-vvp4-63h8-v5pm) within the AsyncHttpClient (AHC)

The AsyncHttpClient library features a critical vulnerability in its cookie store implementation where the underlying architecture completely ignores the scheme

When WebSocket compression is enabled in AsyncHttpClient via setEnablewebSocketCompression(true), the application installs Netty’s shared WebSocketClientCompressionHandler.INSTANCE. Because the frame aggregator sits

The vulnerability resides within the workflow structured output resolution logic of the PraisonAI framework, specifically inside the `AgentFlow._resolve_pydantic_class` method located

The AsyncHttpClient library relies on the ThreadSafeCookieStore component to manage and store HTTP cookies during network requests. The vulnerability arises

When an application using Pydantic AI opts a URL into local network access—either via FileUrl with force_download=’allow-local’ or web_fetch_tool(allow_local_urls=True)—the cloud-metadata

The vulnerability resides in the `GetSlicers` function of the Excelize library, specifically within slicer.go. When processing worksheet parts, the code

The AsyncHttpClient (AHC) library contains a security vulnerability where request replaying mechanisms through ResponseFilters or IOException retries improperly handle target

The vulnerability resides in the Go spreadsheet processing library Excelize, specifically within its worksheet iteration mechanism handling row numbers. When

CVE-2026-61446 is a critical security flaw affecting the plugin manager in the praisonaiagents package prior to version 1.6.78. The vulnerability

CVE-2026-107215 affects the Excelize Go language library for reading and writing Microsoft Excel spreadsheets, specifically within the `extractPart` function located

The CVE-2026-107214 vulnerability affects the Excelize Go package. It targets the file decryption handling for OLE compound documents. Applications using

CVE-2026-57827 represents a critical security vulnerability discovered within the widely deployed RSFiles! file management component designed for the Joomla content

CVE-2026-33894 is a critical cryptographic signature verification vulnerability affecting the node-forge library, a native JavaScript implementation of Transport Layer Security

The vulnerability designated as CVE-2025-47273 represents a severe path traversal flaw residing within the PyPA setuptools package. Specifically, the flaw

CVE-2024-3094 represents a critical supply-chain backdoor discovered in the upstream tarballs of XZ Utils versions 5.6.0 and 5.6.1. This vulnerability

CVE-2026-67279 is a critical remote code execution vulnerability impacting MikroTik RouterOS within the SSH subsystem. Specifically, the vulnerability stems from

CVE-2026-65182 is an improper access control and incorrect authorization vulnerability residing within Apache Tomcat’s security constraint processing mechanism. The flaw

The analyzed vulnerability concerns the SbomGenerator graphical user interface. Specifically, it involves the remediation view module within the application. When

CVE-2026-19118 represents a critical time-of-check time-of-use race condition vulnerability discovered within GitHub Enterprise Server. The flaw specifically targets the repository

CVE-2026-61500 is a critical authentication-bypass and remote code execution vulnerability discovered in Rejetto HTTP File Server (HFS) versions 3.0.0 through

An unconfirmed or mishandled pre-release check in cve-lite-cli historically caused compareVersions to rank a pre-release above its associated release, violating

CVE-2021-44228, commonly known as Log4Shell, is a critical zero-day vulnerability affecting the Apache Log4j Java logging library versions 2.0-beta9 through

CVE-2026-31802 is a security flaw. It affects node-tar in Node.js. Versions prior to 7.5.11 are vulnerable. The issue involves symlink

The analysis of the target repository indicates a complete absence of official software releases, security policies, and package binaries. When

The vulnerability arises within automated software bill of materials and compliance reporting mechanisms when handling unverified upstream dependencies. Specifically, in

CVE-2024-51482 represents a critical security flaw affecting open-source software. It specifically impacts ZoneMinder versions from 1.37.0 up to 1.37.64. The

The CVE-2026-19203 vulnerability targets open-source software ecosystems and repository hosting platforms through sophisticated supply chain injection techniques. Attackers deploy trojanized

The vulnerability identified as CVE-2026-39860 stems from an improper handling of symbolic links during fixed-output derivation output registration within the

The vulnerability identified as CVE-2026-75884 represents a severe security flaw residing within the container group component of the Ansible AWX

Log4Shell is a critical vulnerability affecting the Apache Log4j library, specifically versions 2.0-beta9 to 2.14.1, which arises from improper handling

CVE-2024-38949 is a heap buffer overflow vulnerability affecting the libde265 HEVC/H.265 video codec library version 1.0.15 and prior. The flaw

CVE-2024-21626 is a critical container escape vulnerability residing within the runc container runtime, which is heavily utilized by enterprise platforms

CVE-2023-24329 is a critical security vulnerability affecting Python’s standard library component urllib.parse. The flaw arises from improper input validation when

CVE-2026-18428 is a denial-of-service vulnerability affecting GitHub Enterprise Server instances that process repository release notes configuration files. When a repository

CVE-2021-44228 is a critical vulnerability affecting the Apache Log4j logging library. The flaw arises from improper handling of lookups in

CVE-2025-55182 is a severe pre-authentication remote code execution vulnerability impacting React Server Components within versions 19.0 through 19.2.0. The vulnerability

CVE-2023-23397 is a critical elevation of privilege vulnerability discovered in Microsoft Outlook. The vulnerability allows an authenticated attacker to exploit

The vulnerability designated as CVE-2026-63030 represents a critical security flaw affecting multiple platforms and core components, prominently chaining with SQL

CVE-2026-3854 represents a critical remote code execution vulnerability residing within the core git push processing pipeline of GitHub Enterprise Server.

CVE-2021-41773 is a critical path traversal vulnerability affecting Apache HTTP Server version 2.4.49. The vulnerability arises from an incomplete and

CVE-2026-48710 is a security vulnerability discovered in Starlette, a lightweight ASGI framework and toolkit commonly used in asynchronous Python applications.

CVE-2023-4863 represents a severe heap buffer overflow flaw discovered within the open-source libwebp image processing library. The core issue originates

CVE-2024-41656 is a critical stored Cross-Site Scripting (XSS) vulnerability affecting the Sentry error tracking and performance monitoring platform. The flaw

CVE-2026-63030, widely known as the WP2Shell vulnerability, represents a critical security flaw residing within WordPress Core. It enables unauthenticated remote

Log4j is a widely utilized Java-based logging library. The vulnerability exists within the JNDI lookup mechanism. Log4j handles configuration messages

CVE-2024-53961 is a critical path traversal vulnerability affecting Adobe ColdFusion versions 2023 Update 11 and earlier, as well as 2021

CVE-2026-105744 is a severe security flaw discovered within the Docling document processing library. It specifically impacts the LaTeX backend when

The vulnerability known as a Regular Expression Denial of Service (ReDoS) occurs within the content import functionality of the Ghost

The security vulnerability designated as CVE-2026-105645 affects the Ghost content management system, specifically within its external media inliner component. The

The vulnerability tracked as CVE-2026-105642 exists within the Ghost content management system, specifically affecting versions 6.56.0 through 6.66.3. It stems