•about 1 hour ago•CVE-2026-63223
9.8CVE-2026-63223: Unrestricted File Upload leading to Remote Code Execution in CodeIgniter4
A critical unrestricted file upload vulnerability (CWE-434) in CodeIgniter4 allows unauthenticated remote attackers to execute arbitrary code. By bypassing weak validation filters in the `is_image` and `mime_in` rules, an attacker can upload a malicious PHP payload disguised as a valid image file.
0 views•6 min read
•about 2 hours ago•CVE-2026-67422
7.5CVE-2026-67422: Regular Expression Denial of Service in pymdown-extensions
A high-severity Regular Expression Denial of Service (ReDoS) vulnerability in pymdown-extensions versions prior to 11.0.1 affects the Caret, Tilde, BetterEm, and MagicLink inline processors. When parsing user-supplied Markdown content containing malicious sequences of formatting delimiters, the regular expression engine is forced into catastrophic backtracking, resulting in CPU exhaustion and application denial of service.
2 views•5 min read
•about 3 hours ago•CVE-2026-71847
8.7CVE-2026-71847: Use-After-Free in Ruby JSON Gem ResumableParser
A technical analysis of the use-after-free (UAF) vulnerability in the Ruby JSON gem (CVE-2026-71847) that impacts versions 2.20.0 through 2.21.1. This vulnerability occurs when parsing incomplete stream data containing duplicate keys.
2 views•6 min read
•about 4 hours ago•CVE-2026-71848
5.3CVE-2026-71848: Algorithmic Complexity Denial of Service in Hono languageDetector Middleware
An Algorithmic Complexity Denial of Service (DoS) vulnerability exists in the Hono web application framework within its languageDetector middleware. From version 4.12.0 to 4.12.33, the progressive language-tag truncation routine (normalizeLanguage) performs string operations with a quadratic time complexity O(N^2) relative to the number of hyphen-separated subtags in the user-supplied language tag. This allows an unauthenticated remote attacker to cause resource exhaustion and CPU spikes, resulting in a full denial of service of the single-threaded JavaScript runtime.
3 views•5 min read
•about 5 hours ago•CVE-2026-71849
3.7CVE-2026-71849: Information Exposure via Hop-by-Hop Header Leakage in Hono Proxy Helper
A vulnerability in the Hono framework's Proxy Helper allows the exposure of connection-scoped, internal, or session-specific metadata to unauthorized actors. The proxy helper fails to remove header fields dynamically listed in the response's Connection header, violating RFC 9110 Section 7.6.1.
3 views•6 min read
•about 6 hours ago•CVE-2026-71850
4.8CVE-2026-71850: Server-Side Rendering Data Exposure in Hono JSX Memoization
A session data exposure vulnerability in the Hono web application framework (hono/jsx module) allows consecutive users to receive cached HTML outputs containing private data. When JSX components wrapped in `memo()` are rendered on the server, the caching mechanism utilizes a module-level closure that persists across independent HTTP requests. When subsequent requests occur with matching props, the components are not re-evaluated, and cached HTML is served. If these components read request-scoped or session-specific data via ambient APIs, the data of the first user is exposed to subsequent users.
3 views•6 min read
•about 7 hours ago•CVE-2026-71851
9.0CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom)
A severe, twelve-year-old cryptographic weakness in crypto-js (versions < 4.0.0) generated pseudorandom numbers using a custom Multiply-With-Carry (MWC) algorithm seeded from the non-secure Math.random(). This reduces 128-bit and 256-bit key spaces to just 2^39 and 2^47 possibilities, allowing offline brute-force attacks.
5 views•7 min read
•about 8 hours ago•CVE-2026-71870
4.8CVE-2026-71870: Uncontrolled Resource Consumption (DoS) in pypdf ToUnicode CMap Parsing
An uncontrolled resource consumption vulnerability (CWE-400) exists in pypdf prior to version 6.15.0. When extracting text from a specially crafted PDF document, the parser fails to restrict token lengths within /ToUnicode CMap streams, causing unbounded memory allocation and process termination via Out-of-Memory (OOM) crashes.
6 views•7 min read
•about 9 hours ago•CVE-2026-71852
4.8CVE-2026-71852: Denial of Service via Excessive Iteration and Memory Exhaustion in pypdf CID Font Parsing
A Denial of Service (DoS) vulnerability exists in pypdf prior to version 6.15.0. When parsing maliciously crafted PDF files containing excessively large CID font width ranges, the library suffers from CPU starvation and memory exhaustion due to unconstrained loop expansion.
7 views•7 min read
•about 10 hours ago•CVE-2026-56818
6.5CVE-2026-56818: Denial of Service via Memory Pinning in Netty Redis Array Aggregator
A vulnerability in Netty's Redis codec allows remote unauthenticated attackers to cause a memory-pinning Denial of Service (DoS) due to the failure to release partial aggregate state when specific error conditions occur in RedisArrayAggregator. When processing Redis Serialization Protocol (RESP) messages, the aggregator fails to clear internal queues and release retained direct byte buffers on exception paths triggered by exceeded maxElements or invalid length properties. If the pipeline does not explicitly tear down the connection upon detecting a decoder error, subsequent elements continue utilizing the stale context, allowing memory blocks to remain indefinitely pinned.
8 views•5 min read
•about 11 hours ago•CVE-2026-54164
6.5CVE-2026-54164: Missing IRI Type Validation in API Platform Core Enables Resource Type Confusion
CVE-2026-54164 is a class/type confusion vulnerability (CWE-843) in API Platform Core. When processing relationships via Internationalized Resource Identifiers (IRIs) in write requests, the framework's normalizer fails to verify if the resolved resource matches the expected type. For PHP applications utilizing untyped properties, the mismatched object is silently assigned, breaking domain logic and data integrity.
5 views•6 min read
•about 12 hours ago•GHSA-WVPP-8HX9-P66J
9.8GHSA-WVPP-8HX9-P66J: Arbitrary Command Execution via Option Guard Bypass in GitPython
An unsafe option guard bypass vulnerability exists in GitPython before version 3.1.58. When keyword arguments are passed to Git commands with split_single_char_options=False, GitPython's argument validation helper fails to inspect the combined short-option value. This discrepancy allows short-option token smuggling or clustering manipulation, enabling remote attackers to bypass option blocklists and execute arbitrary system commands.
7 views•8 min read