Security Advisories

medium2026-09-29

CVE-2026-49265-Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

medium2026-09-29

CVE-2026-49264-Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

View chart

oauthlib/oauthlib · GHSA-hj66-6f7g-4r5v

high2026-09-29

CVE-2026-76844-webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

View chart

webpack/webpack-dev-middleware · GHSA-g84c-rxfj-3j2c

medium2026-09-28

Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

View chart

nodemailer/nodemailer · GHSA-6vj9-mwq6-2f5v

medium2026-09-28

CVE-2026-85024-undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

View chart

nodejs/undici · GHSA-3wwx-pv8p-q78v

medium2026-09-28

CVE-2026-88932-multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

View chart

expressjs/multer · GHSA-3pph-fpjx-jg34

medium2026-09-28

CVE-2026-87859-morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

View chart

expressjs/morgan · GHSA-9f6g-j8ch-79g4

high2026-09-28

CVE-2026-101895-Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

View chart

angular/angular · GHSA-f67j-2jqw-jpq7

high2026-09-28

CVE-2026-84292-fast-uri vulnerable to authority injection via an unvalidated port in serialize

View chart

fastify/fast-uri · GHSA-qw65-cvwx-89v3

high2026-09-28

CVE-2026-84394-fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

View chart

fastify/fast-uri · GHSA-58mr-gqgx-xq4g

medium2026-09-28

CVE-2026-83557-jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

View chart

fasterxml/jackson-databind · GHSA-gx83-3vf8-gh7j

medium2026-09-28

CVE-2026-101913-ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

View chart

beaugunderson/ip-address · GHSA-rpw4-54j3-4h4q

medium2026-09-28

CVE-2026-101910-ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

View chart

beaugunderson/ip-address · GHSA-2vr4-cq9g-pvrc

high2026-09-28

CVE-2026-88058-Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

View chart

angular/angular · GHSA-j3r3-mxqp-r2p4

high2026-09-28

CVE-2026-68497-jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

View chart

fasterxml/jackson-databind · GHSA-q4xh-88c3-wmh7

medium2026-09-28

CVE-2026-19032-jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

View chart

fasterxml/jackson-databind · GHSA-wjgm-6hv5-3cvf

medium2026-09-28

CVE-2026-77310-jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

View chart

fasterxml/jackson-databind · GHSA-vvgp-rfg2-7rr6

medium2026-09-28

CVE-2026-101914-@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

View chart

grpc/grpc-node · GHSA-88h9-xgvx-hvf2

medium2026-09-28

CVE-2026-61834-scim-patch: Mutation of Inherited Built-in Method Objects

View chart

thomaspoignant/scim-patch · GHSA-2mhw-wcx5-v3xj

high2026-09-28

code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)

View chart

ai-action/code-ollama · GHSA-456v-xq2p-r4cj