Author name: UNDERCODE

CVE-2026-90776 is a quadratic time complexity vulnerability in the `addressparser` component of Nodemailer, a widely used email library for Node.js.

CVE-2026-100700 is a denial of service vulnerability in Nodemailer, a widely used email-sending library for Node.js. The flaw resides in

CVE-2026-102277 is a quadratic-time algorithmic complexity vulnerability in the npm `brace-expansion` package’s `expand()` function. The flaw is triggered by crafted

CVE-2026-101911 is an uncontrolled resource consumption vulnerability in the `ip-address` library for Node.js, affecting all versions prior to 10.7.1. The

CVE-2026-86472 is a medium-severity vulnerability in the `fast-uri` library, a dependency-free RFC 3986 URI parser for Node.js used by widely

Nodemailer’s address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. The mailto scheme parser was

This vulnerability affects the JavaScript date library moment, specifically versions 2.29.2 through 2.30.1. It is a path traversal issue that

PyJWT 2.13.0 validates empty HMAC keys inconsistently. A raw empty str/bytes HMAC key is rejected by HMACAlgorithm.prepare_key. The same zero-length

The vulnerability affects @nestjs/microservices. It impacts TCP and RabbitMQ transports. A client sends one message. The message pattern is deeply

The `ip-address` npm library is a JavaScript utility for parsing and manipulating IPv4 and IPv6 addresses. Prior to version 10.7.1,

CVE-2026-102599 is a denial-of-service vulnerability that affects Engine.IO and Socket.IO servers which permit transport upgrades. The Engine.IO protocol revision is

Intro: PyJWT 2.13.0 affected; 2.14.0 fixed. PyJWS._load() is at jwt/api_jws.py:337. It splits the compact JWS token. It base64url decodes the

The vulnerability resides in the `expand_()` function of the brace-expansion package, which is a core dependency used by `minimatch` and

CVE-2026-14257 Mechanism The vulnerability in `parseCommaParts()` allows an attacker to exhaust the native call stack and crash the process through

PyJWT 2.13.0 has incomplete algorithm-confusion defense. The library can verify JWTs with HS256, HS384, or HS512. It can also verify

HMACAlgorithm.prepare_key blocks asymmetric keys from being used as HMAC secrets. It searches for text markers only. It looks for –BEGIN

PyJWT 2.13.0 added HMACAlgorithm.prepare_key() guard at jwt/algorithms.py near line 344. The guard is intended to stop RSA public key material

CVE-2026-48524 affects PyJWT’s PyJWKClient. It was tracked as GHSA-fhv5-28vv-h8m8. The vulnerability is an unauthenticated denial of service. Attacker-controlled kid values

CVE-2026-77301 is a memory allocation vulnerability in the adm-zip library, a JavaScript implementation for ZIP archive handling in Node.js. The

CVE-2022-29217 fixed an algorithm-confusion issue in PyJWT. PyJWT rejects an asymmetric key passed to an HMAC algorithm. The rejection is

The adm-zip library for Node.js contains a critical inconsistency in how it handles ZIP archives that contain multiple entries sharing

PyJWT 2.13.0 accepts compact JWS signature segments containing characters outside the Base64URL alphabet. A valid compact JWS normally uses only

adm-zip exposes async decompression APIs used by Node.js services. methods/inflater.js inflateAsync creates zlib.createInflateRaw. It feeds attacker-controlled compressed bytes via tmp.end(inbuf).

PyJWT provides PyJWKClient for fetching JSON Web Key Sets. PyJWKClient normally retrieves JWKS from a configured trusted endpoint. In PyJWT

The ammonia crate is a popular HTML sanitization library written in Rust. It is designed to remove potentially dangerous HTML

CVE-2026-102672 is a local race condition vulnerability affecting Electron applications on macOS. On macOS, Electron bundles the Squirrel.Mac auto-update framework,

CVE-2026-85152 is a high-severity origin validation error in the undici HTTP client library that allows cross-origin cache poisoning and information

undici WebSocket client performs opening handshake. Client sends HTTP Upgrade request. Default new WebSocket(url) requests no subprotocol. Server responds 101

The vulnerability affects undici’s RetryHandler. RetryHandler can leave a response body pending indefinitely. When a retried request receives a non-retryable

CVE-2026-102601 is a vulnerability in the PHP League’s Flysystem file storage library that allows malformed UTF-8 sequences in file paths

The vulnerability exists in Laravel’s exception debug page rendering pipeline when the application is configured with APP_DEBUG=true. Under this condition,

The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character

CVE-2026-102673 is a high-severity vulnerability in Electron, a framework for building cross-platform desktop applications using JavaScript, HTML, and CSS. The

undici implements WebSocketStream. WebSocketStream wraps WebSocket connections. It exposes readable and writable streams. Applications write through a writer lock. A

Electron is a framework for building cross-platform desktop applications using web technologies. This vulnerability allows windows opened from a sandboxed

Joi is a validation library used by Node.js applications. Joi.string().isoDate() validates ISO 8601 date strings. The rule applies regular expressions

adm-zip is a Node.js library for creating and extracting zip archives. When keepOriginalPermission=true is passed to extractAllTo() or extractEntryTo(), adm-zip

The undici HTTP client library contains a critical logic error in its cache interceptor mechanism. The interceptor’s documentation states that

CVE-2026-84961 undici’s BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the `go.opentelemetry.io/otel/sdk/log` BatchingProcessor can enter a tight CPU loop

PyJWT parses JSON Web Key Sets through PyJWKSet and PyJWK. A JWK Set contains multiple keys under the “keys” list.

Electron’s sandboxed preload script cache contains a critical validation flaw that allows cache poisoning attacks. When Electron loads a sandboxed

undici provides an HTTP client and cache interceptor for Node.js. The vulnerable component is `interceptors.cache()`. It does not handle `Set-Cookie`

Undici’s `interceptors.retry()` can resume a request after a partial response and append the resumed bytes to an already partially delivered

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML, and CSS. The vulnerability resides in the handling

CVE-2026-39244 affects adm-zip version 0.6.0. The package is used to read, write, and extract ZIP archives in Node.js. The original

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in the `PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey()` method. The vulnerable method is reachable

CVE-2026-49265: PKCE Timing Side-Channel in oauthlib Authorization Code Grant A timing side-channel vulnerability exists in the Proof Key for Code

oauthlib RevocationEndpoint with enable_jsonp=True reflects request.callback into JavaScript response body. The vulnerable file is oauthlib/oauth2/rfc6749/endpoints/revocation.py. Error path lines 72-73 wrap

The `js-yaml` library provides a configuration parameter called `maxTotalMergeKeys` designed to limit the total number of keys processed during YAML

The vulnerability arises from two independent quadratic computational complexity paths within markdown-it’s `linkify: true` handling. Both issues are located in

CVE-2026-76844 affects webpack-dev-middleware. It is a path traversal issue. It occurs in getFilenameFromUrl. The function resolves requests to local files.

CVE-2026-86950 is a critical out-of-bounds write vulnerability affecting Apple’s CoreGraphics framework, a foundational component responsible for graphics and rendering functions

undici’s WebSocket client, which is also bundled into Node.js as the global globalThis.WebSocket, contains a critical flaw in its `permessage-deflate`

fast-uri is a dependency-free URI parsing and serialization library for JavaScript/Node.js maintained under the OpenJS Foundation. CVE-2026-84292 is a high-severity

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket ([ or ]) without reporting an error. A

A Denial of Service (DoS) vulnerability exists in @angular/platform-server’s DOM emulation parser, domino. When processing untrusted user input containing an

The `ip-address` library’s `Address6.isLinkLocal()` method incorrectly identifies link-local addresses. It checks for `fe80::/64` instead of the correct `fe80::/10` range. Link-local

Address6 in ip-address 10.2.0 through 10.5.0 lacks classifiers for the NAT64 local-use range 64:ff9b:1::/48. RFC 8215 reserves 64:ff9b:1::/48 for operator-chosen

CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an eager-DNS-resolution / SSRF issue in jackson-databind deserialization of java.net.InetSocketAddress. The fix switched the InetSocketAddress branch to

A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URI(value) then Path.of(uri). If Path.of

The @grpc/grpc-js package implements gRPC for Node.js. It supports RBAC authentication rules for service methods. RBAC rules can match method

CVE-2026-88772 is a critical memory overflow vulnerability residing within the core architecture of Citrix NetScaler ADC and NetScaler Gateway appliances.

Technical CVE-2026-88771 is a critical improper input validation vulnerability (CWE-20) that affects Citrix NetScaler ADC and Citrix NetScaler Gateway appliances.

The AetherBrowser API server in scripts/aetherbrowser/api_server.py exposes POST /api/ops/check-email without authentication. The route is registered at line 3008 with plain

CVE-2026-59695 is a high-severity vulnerability in the ZenHive mpp Elixir library, affecting versions from 0.2.0 before 0.6.0. When the library

The CliInvoke.Specializations package provides PowerShell and Cmd shell wrappers, specifically the PowershellProcessInvoker and CmdProcessInvoker invokers, along with UsePowerShell and UseCmd

When the mpp Elixir library is configured as fee payer (fee_payer: true), the `MPP.Methods.Tempo` payment method co-signs and broadcasts a

Knowns MCP docs and memory tools contain multiple unrestricted path traversal flaws. The storage layer in doc_store.go and memory_store.go builds

The vulnerability arises from two distinct locations within the confidential token framework where an encrypted handle returned by an untrusted

The vulnerability resides in the `get_page_template()` function within WordPress core, which is responsible for resolving the appropriate template file for

An unauthenticated account takeover vulnerability exists in the fof/oauth extension for Flarum when the Discord OAuth provider is enabled. Discord

Improper control of generation of code (‘code injection’) in Microsoft Office SharePoint allows an authorized attacker to execute code over

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding

CVE-2026-61825 is a stored cross-site scripting vulnerability in code16/sharp, a Laravel-based framework for building content-management and administrative interfaces. The flaw

http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a

Ash builds changesets from parameter maps. Private arguments use public?: false. They should be set only by trusted server-side code.

When createAction runs against a remote StorageClient, the storage server returns outputs to build. buildSignableTransaction takes each non-change output’s lockingScript

CVE-2026-5430: JWT Authentication Bypass via Unsupported Algorithm Validation in WSO2 Products The JWT authentication mechanism in multiple WSO2 products accepts

The `vk-app` backend in `social-auth-core` versions prior to 5.0.0 fails to enforce signature verification when the `auth_key` parameter is omitted

The vulnerability exists in @rsdoctor/rspack-plugin. The default Rsdoctor report HTTP server binds to 0.0.0.0. Node.js server.listen(port, callback) has no host

CVE-2026-56737 is a critical authentication bypass vulnerability affecting phpMyFAQ versions 3.2.0 through 4.1.5. The flaw resides in the public two-factor

hpack, Unbounded variable integer decoding, CVE-2026-59980 (Moderate) CVE-2026-59980 is a denial-of-service vulnerability affecting the python-hyper/hpack library, an HTTP/2 header compression

The vulnerability resides in the Vend OAuth2 backend of the python-social-auth library, specifically within versions prior to 5.0.0. The core

CVE-2026-57175 is an improper authentication vulnerability affecting the Python Social Auth library, specifically the `social-core` package, prior to version 5.0.0.

to the Vulnerability The `langchain-nvidia-ai-endpoints` package, an integration connecting LangChain with NVIDIA AI Foundation Models and NIM microservices, contained a

xhtml-purifier is a Node.js library designed to sanitize untrusted HTML by removing dangerous elements and attributes, outputting a purified string

CVE-2026-61816 is an uncontrolled resource consumption and algorithmic complexity vulnerability (CWE-400) that affects any application parsing untrusted email with the

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. The vulnerability exists in the Gateway API controller

CVE-2026-46439 affects the Trestle Jinja authoring path. The original fix removed a recursive re-render loop in render_template. That loop was

CVE-2026-57179 is a session fixation vulnerability (CWE-384) in the Python Social Auth library, specifically within its partial-pipeline resume mechanism. The

The crate exports a public safe API Rules::deserialize accepting any generic byte sequence B: AsRef< >. It restores compiled rule

CVE-2026-85056 is a high-severity authentication bypass vulnerability affecting ZITADEL’s Login V2 UI, an open-source identity management platform. The flaw resides

Snipe-IT’s uploaded-files API accepts XML documents and later serves them inline without applying the safe-inline allowlist used by the equivalent

Snipe-IT is an open-source IT asset and license management system built on the Laravel PHP framework. CVE-2026-63493 is an improper

SunEditor is a lightweight WYSIWYG editor built in vanilla JavaScript with no dependencies. In versions prior to 2.47.11, the internal

The rex_list component in REDAXO reads the SQL sort column directly from the sort GET parameter. It does not validate

ReactPress is a publishing system for React developers built on NestJS and TypeORM. Prior to version 3.7.0, the API list

The vulnerability CVE-2026-57576 affects Plone. It resides in plone.app.dexterity and plone.app.contenttypes. Plone is a content management system. An authenticated user