•27 minutes ago•CVE-2026-84452
8.6CVE-2026-84452: Localhost Remote Code Execution via CORS Misconfiguration in Windows ML CLI
A critical vulnerability (CVE-2026-84452) in the Windows ML CLI (winml-cli) HTTP server component allows unauthenticated remote code execution via permissive CORS and lack of request validation.
1 views•7 min read
•about 1 hour ago•CVE-2026-15603
5.3CVE-2026-15603: Log Forging via Unescaped Unicode Line Separators in morgan Middleware
An incomplete fix vulnerability (CVE-2026-15603) in the morgan HTTP request logger middleware for Node.js allows unauthenticated remote attackers to forge log entries. The flaw arises because the escaping mechanism does not neutralize Unicode line separator characters, enabling attackers to inject payloads that trick downstream log processors into splitting single log records into multiple logical entries.
3 views•6 min read
•about 3 hours ago•CVE-2026-82333
7.5CVE-2026-82333: Remote Denial of Service via Sparse Array Manipulation in Multer
A high-severity denial of service vulnerability in the Node.js middleware 'multer' allows unauthenticated remote attackers to exhaust CPU resources and freeze applications. By submitting small, specially crafted 'multipart/form-data' requests containing large array indices alongside conflicting parameter keys, attackers force synchronous execution loops over up to 4.2 billion elements within the underlying 'append-field' library.
10 views•7 min read
•about 4 hours ago•CVE-2026-77063
3.7CVE-2026-77063: File Size Limit Bypass via Asynchronous Race Condition in Multer
CVE-2026-77063 details a security flaw in multer, the standard multipart/form-data handler for Node.js, where asynchronous file filters introduce a race condition. This condition causes the library to miss file size limitation events, resulting in the silent acceptance of truncated files.
5 views•7 min read
•about 5 hours ago•CVE-2026-77037
7.5CVE-2026-77037: File Descriptor Leak and Denial of Service in Multer Disk Storage
A resource consumption vulnerability exists in the multer library version 2.2.0 when utilizing the disk storage engine. When a remote client aborts or truncates an in-progress file upload, multer removes the partial file from the disk but fails to properly close the active write stream. This behavior leaves the underlying file descriptor open in the operating system, allowing a remote attacker to systematically exhaust the server's file descriptor limits and trigger a Denial of Service.
9 views•5 min read
•about 6 hours ago•CVE-2026-77078
7.5CVE-2026-77078: Remote Denial of Service in Multer Middleware via Array Suffix Handling
CVE-2026-77078 is a critical denial of service vulnerability in the multer Node.js package, allowing unauthenticated remote attackers to crash the runtime process using a single crafted multipart/form-data HTTP payload.
6 views•4 min read
•about 7 hours ago•GHSA-2Q42-4Q24-7RGV
7.9Path Traversal Vulnerability in Microsoft TypeSpec Core and Emitter Packages
A path traversal vulnerability (CWE-22) in the Microsoft TypeSpec compiler core and associated emitter packages permits unvalidated user input to escape the designated output directory, resulting in arbitrary JSON and YAML file creation or modification on the host system.
3 views•7 min read
•about 8 hours ago•GHSA-CC9R-2J5M-2M83
9.1GHSA-CC9R-2J5M-2M83: Parser Differential and Domain Validation Bypass in Nodemailer
A critical parser differential vulnerability exists in Nodemailer prior to version 9.1.0. An attacker can bypass recipient-domain validation checks by utilizing RFC 5322 comments, leading to unauthorized email routing.
7 views•3 min read
•about 9 hours ago•GHSA-2X7J-588G-CCC2
7.5GHSA-2x7j-588g-ccc2: Algorithmic Complexity Denial of Service in Nodemailer
An algorithmic complexity vulnerability in Nodemailer before version 9.1.0 allows remote attackers to block the Node.js event loop. This denial of service is triggered by processing large or complex lists of email addresses, leading to quadratic resource consumption.
5 views•5 min read
•about 10 hours ago•GHSA-WMMP-3585-3RMP
5.9GHSA-WMMP-3585-3RMP: IDN/Punycode Domain Allow-list Bypass in Nodemailer
Nodemailer (prior to version 9.1.0) is vulnerable to an IDN/Punycode domain allow-list bypass due to an interpretation conflict between legacy RFC-3492 codecs and modern UTS-46 Unicode parsers.
6 views•6 min read
•about 11 hours ago•CVE-2026-86996
5.3CVE-2026-86996: Missing Authorization in n8n AI Agent Workflow Tool Execution
A missing authorization vulnerability (CWE-862) exists in n8n where AI Agent workflows executing as tools bypass the Sub-Workflow Caller Policy settings, allowing authenticated users with agent creation privileges to invoke unauthorized sub-workflows across project boundaries.
11 views•6 min read
•about 12 hours ago•CVE-2026-83612
8.7CVE-2026-83612: Algorithmic Complexity and Denial of Service via Output Amplification in xmldom
A Denial of Service (DoS) vulnerability exists in the xmldom library when parsing HTML-mode documents with mixed-case closing tags for raw-text or escapable raw-text elements like script, style, textarea, or title. This leads to algorithmic complexity issues and quadratic output amplification during DOM serialization.
9 views•6 min read