Tagged “cve.org”
CVEs tagged cve.org, newest first.
47225 CVEsRSS
CVE-2026-118258Low· 3.7PoCi18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates withou…
CVE-2026-55458Low· 2.9Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
CVE-2026-118651Medium· 5.3Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
CVE-2026-118653Medium· 5.3PoCEcho has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
CVE-2026-118266Medium· 5.3PoCEcho has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
CVE-2026-118652Medium· 6.1PoCEcho vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
CVE-2026-118650High· 7.5PoCEcho's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
CVE-2026-118253High· 8.4Highcharts Dashboards: fullscreen labels are parsed as HTML
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards langua…
CVE-2026-118255High· 8.4Highcharts Grid: javascript: URL in credits.href runs script on click
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a ja…
CVE-2026-118254High· 8.6Highcharts Grid: pagination language options are parsed as HTML
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can …
CVE-2026-118252High· 8.4Highcharts Dashboards: sidebar component labels are parsed as HTML
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashb…
CVE-2026-118251High· 8.4Highcharts: javascript: URL in credits.href runs script on click
Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-schem…
CVE-2026-116794High· 8.3PoCrussh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONST…
CVE-2026-116531Critical· 9.1HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk
HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffe…
CVE-2026-116285High· 7.5HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\…
CVE-2026-116134High· 7.5HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block
HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limi…
CVE-2026-116132High· 7.1HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the pa…
CVE-2026-117501High· 7.5HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. …
CVE-2026-116795High· 7.5PoCRE2JS: Quadratic-time denial of service in re2js lookbehind matching
RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().rep…
CVE-2026-116133High· 7.5HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffer…
CVE-2026-116131Medium· 6.5HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts
HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the whole body on its separators at once, creating one scala…
CVE-2026-117500High· 7.5HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload
HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $…
CVE-2026-116135Critical· 9.8HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them
HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escap…
CVE-2026-79656Medium· 6.0OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana wri…
CVE-2026-58458Medium· 6.5Don't Starve Together Memory Corruption via world_gen_data
Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game…
CVE-2026-84725High· 8.1Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in…
CVE-2026-116796High· 7.2Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker…
CVE-2026-116797High· 8.5Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
CVE-2026-105614Medium· 4.7PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()
PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an attacker to provide a small image with enormous declared dimensions. This vulnerability can be exploited to exha…
CVE-2026-105612Low· 3.5PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles
PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions