Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flow…

▾ Abyssalelixir-grpc · grpcEPSS 0.78%via NVD

CVE-2026-48599High· 7.6PoC

4mo ago

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the qu…

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the qu…

▾ Midnightelixir-grpc · grpcEPSS 0.34%via NVD

CVE-2026-48854High· 8.7PoC

4mo ago

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.G…

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.G…

▾ Midnightelixir-grpc · grpcEPSS 0.45%via NVD

CVE-2026-54267High

4mo ago

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

▾ Twilightangular · @angular/coreEPSS 0.38%via GHSA

CVE-2026-49982High· 8.2

4mo ago

tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template

▾ Twilighttmp · tmpEPSS 0.50%via GHSA

CVE-2026-50168High

4mo ago

@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass

▾ Twilightangular · @angular/platform-serverEPSS 0.24%via GHSA

CVE-2026-50169Medium

4mo ago

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

▾ Sunlitangular · @angular/service-workerEPSS 0.23%via GHSA

CVE-2026-48761Medium

4mo ago

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

▾ Sunlitsymfony · symfony/html-sanitizerEPSS 0.26%via GHSA

CVE-2026-52725Medium

4mo ago

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

▾ Sunlitangular · @angular/coreEPSS 0.46%via GHSA

CVE-2026-50170High

4mo ago

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

▾ Twilightangular · @angular/commonEPSS 0.43%via GHSA

CVE-2026-50171High

4mo ago

@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

▾ Twilightangular · @angular/commonEPSS 0.26%via GHSA

CVE-2026-50184Medium

4mo ago

@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

▾ Twilightangular · @angular/platform-serverEPSS 0.27%via GHSA

CVE-2026-50557Medium

4mo ago

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

▾ Sunlitangular · @angular/coreEPSS 0.41%via GHSA

CVE-2026-54265Medium

4mo ago

@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

▾ Sunlitangular · @angular/compilerEPSS 0.34%via GHSA

CVE-2026-54266High

4mo ago

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

▾ Twilightangular · @angular/commonEPSS 0.13%via GHSA

Tagged “ghsa”

Cross-site scripting via <NoScript> slot content in Nuxt's head components

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Gogs: Overwriting critical files results in a denial of service

Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication

Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo

Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw

Gitea: Missing repository-unit authorization on issue-template API endpoints

Gitea: Token scope bypass on web archive download endpoint

Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

jsonata: Function Binding Prototype Pollution via hasOwnProperty Override

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flow…

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the qu…

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.G…

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template

@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

@angular/service-worker: Request Credential & Cache Policy Stripping

@babel/core: Arbitrary File Read via sourceMappingURL Comment

vite: `server.fs.deny` bypass on Windows alternate paths

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning