•about 2 hours ago•CVE-2026-114152
8.8CVE-2026-114152: Stack-Based Buffer Overflow and Untrusted Pointer Dereference in Microsoft DiaSymReader.Native
CVE-2026-114152 is a high-severity remote code execution vulnerability affecting Microsoft Visual Studio 2026 and multiple servicing branches of the Microsoft .NET runtime (.NET 8.0, 9.0, 10.0, and 11.0) on Windows platforms. The vulnerability exists within the native symbol reader library, Microsoft.DiaSymReader.Native, specifically inside the DiaObjectFile::ApplyFixup method during the processing of Common Object File Format (COFF) relocation records. By supplying a malformed object file or Program Database (PDB) symbol file containing out-of-bounds relocation offsets or invalid symbol table indices, an unauthenticated attacker can trigger an untrusted pointer dereference (CWE-822) and a stack-based buffer overflow (CWE-121). Successful exploitation occurs when a victim opens, compiles, or debugs a malicious project or symbol artifact, leading to arbitrary code execution within the security context of the active developer environment or build process.
3 views•11 min read
•about 3 hours ago•CVE-2026-118745
8.8CVE-2026-118745: Remote Code Execution via Heap-Based Buffer Overflow in Microsoft Visual Studio and .NET DiaSymReader
CVE-2026-118745 is a high-severity remote code execution vulnerability affecting Microsoft Visual Studio 2026 and multiple supported versions of the .NET runtime (8.0, 9.0, 10.0, and 11.0) on Windows systems. The flaw is a heap-based buffer overflow (CWE-122) located within the native symbol reading library, Microsoft.DiaSymReader.Native, specifically in the routines responsible for extracting and parsing Program Database (.pdb) line number metadata. An attacker can exploit this vulnerability by supplying a crafted .pdb file alongside a repository, project, or compiled binary. When a developer or automated diagnostic process parses the malformed debug symbols, an out-of-bounds heap write occurs, permitting arbitrary code execution within the security context of the active user process.
6 views•10 min read
•about 4 hours ago•CVE-2026-109481
7.5CVE-2026-109481: Cross-Site Request Forgery Leading to Elevation of Privilege in ASP.NET Core
CVE-2026-109481 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in the ASP.NET Core Blazor Server and interactive component architecture. The flaw exists within the internal circuit state synchronization endpoint (`/_blazor/refresh`), which fails to enforce antiforgery token validation or verify cross-origin request headers. By inducing an authenticated victim to issue a cross-site request targeting a pre-allocated circuit identifier, an unauthenticated attacker can bind the victim's security principal to the attacker's active SignalR circuit, resulting in full privilege elevation within the application scope.
5 views•9 min read
•about 5 hours ago•CVE-2026-126187
9.5CVE-2026-126187: Unauthenticated Remote Code Execution in React Server Components
A critical deserialization vulnerability exists in React Server Components (RSC) packages (`react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`) across versions 19.0.0 through 19.3.0. The flaw occurs during the processing of React Flight protocol streams when handling multiple typed arrays sharing a backing ArrayBuffer alongside attacker-controlled inputs. By combining byte-stream buffer detachment semantics with unvalidated thenable invocation and exposed internal response states, an unauthenticated attacker can achieve remote code execution on server runtimes supporting React Server Components.
19 views•11 min read
•about 6 hours ago•CVE-2026-125123
2.3CVE-2026-125123: Improper Output Neutralization and CI Workflow Command Injection in compose-lint CLI Parser
An improper output neutralization vulnerability (CWE-117 / CWE-150) exists in compose-lint version 0.31.0. When compose-lint is invoked on untrusted file paths without a preceding '--' option delimiter, Python's standard argparse module rejects malformed or dash-prefixed paths and writes them directly to standard error without passing through the application's output sanitizer. An attacker submitting a pull request containing crafted directory or file names with carriage returns or Unicode whitespace can inject arbitrary CI workflow commands into GitHub Actions or Azure Pipelines job logs.
5 views•10 min read
•about 7 hours ago•CVE-2026-125116
4.8CVE-2026-125116: Type Confusion in Mongoose Discriminator Resolution
CVE-2026-125116 (GHSA-wr5m-5jph-8m96) is a type confusion vulnerability (CWE-843) in Mongoose, the MongoDB object modeling library for Node.js. When resolving discriminator models or schemas via user-supplied discriminator keys (defaulting to `__t`), Mongoose performs direct property indexing on plain JavaScript registry objects without verifying own-property ownership. Supplying inherited `Object.prototype` property names such as `'constructor'` causes Mongoose to resolve built-in functions rather than valid Mongoose constructors, resulting in unhandled runtime exceptions, schema validation bypasses, and persistent collection query denial of service.
5 views•11 min read
•about 8 hours ago•CVE-2026-125119
7.5CVE-2026-125119: Connection-Level Filter Sanitization Bypass in Mongoose ODM
A flaw in Mongoose's query condition casting pipeline causes the `sanitizeFilter` configuration option to be silently ignored when defined at the connection level via `mongoose.connect()` or `mongoose.createConnection()`. Because internal query methods inspect `Connection.options` rather than `Connection.config`, applications relying on connection-scoped filter sanitization remain vulnerable to NoSQL query selector injection (CWE-943), permitting authentication bypass and unauthorized data access across Mongoose versions 6.x through 9.x.
5 views•9 min read
•about 9 hours ago•CVE-2026-125110
5.3CVE-2026-125110: Path Canonicalization Mismatch and Security Header Bypass in Rack::Static
CVE-2026-125110 is a path canonicalization mismatch vulnerability in Rack (specifically within the Rack::Static middleware component). When serving static files, Rack normalizes the requested URL path to resolve the physical file on disk, but evaluates configured path-specific header rules against an unnormalized, raw path that has only undergone URL percent-decoding. Unauthenticated remote attackers can exploit this discrepancy by injecting raw or percent-encoded dot-segments into HTTP requests, causing Rack to serve restricted static assets without their intended security headers.
7 views•10 min read
•about 10 hours ago•CVE-2026-118776
3.7CVE-2026-118776: Improper PKCS#7 Padding Validation in node-forge CBC and ECB Cipher Modes
CVE-2026-118776 (also tracked as GHSA-2vgq-wchc-25w7) is an improper input and integrity check validation vulnerability affecting the node-forge cryptographic library prior to version 1.4.1. In vulnerable versions, the PKCS#7 unpadding implementations for Cipher Block Chaining (CBC) and Electronic Codebook (ECB) modes only examined the final byte of the decrypted buffer and permitted padding counts up to four times the cipher block size. This defect allowed malformed ciphertexts containing zero-length padding, oversized padding values, or mismatched preceding padding bytes to pass validation, resulting in silent plaintext truncation of up to four blocks and integrity verification bypass in applications relying on unpadding success.
3 views•10 min read
•about 11 hours ago•CVE-2026-118774
3.7CVE-2026-118774: Improper Verification of Cryptographic Signature in node-forge X.509 Certificate Validation
CVE-2026-118774 (GHSA-9wg5-mj3p-v49q) is an improper cryptographic signature verification vulnerability (CWE-347) in node-forge versions prior to 1.4.1. When verifying an X.509 subordinate certificate via certificate.verify(child) or verifyCertificateChain(), the library erroneously selects the RSA padding scheme (e.g., PKCS#1 v1.5 vs. RSASSA-PSS) and RSASSA-PSS parameters from the issuer certificate rather than from the child certificate being verified. This enables an attacker to relabel a PKCS#1 v1.5-signed certificate as an RSASSA-PSS certificate without invalidating the signature check, bypassing downstream security policies that mandate RSASSA-PSS.
5 views•12 min read
•about 12 hours ago•CVE-2026-118670
8.8CVE-2026-118670: DOM-Based Cross-Site Scripting in OHIF Viewers dicom-pdf Extension
CVE-2026-118670 (GHSA-xwgp-w3pj-q5h3) is a high-severity DOM-based Cross-Site Scripting (XSS) vulnerability in OHIF Viewers affecting the dicom-pdf extension module. When processing DICOM Encapsulated Document objects, the viewer extracts the untrusted MIMETypeOfEncapsulatedDocument attribute (tag 0042,0012) and uses it directly to instantiate an in-memory Blob. This Blob is then converted to a same-origin Object URL and embedded into the document via an HTML <object> element. Because browsers prioritize the resource's underlying MIME type over the <object> element's type attribute, an attacker who supplies a crafted DICOM file with a MIME type such as text/html can execute arbitrary JavaScript within the application's origin, compromising session tokens, local storage, and Patient Health Information (PHI).
4 views•9 min read
•about 13 hours ago•CVE-2026-103022
5.3CVE-2026-103022: Denial of Service via Unhandled Unicode Exception and File Descriptor Leak in Urwid Web Display
A Denial of Service (DoS) vulnerability exists in the web display module (urwid/display/web.py) of the Urwid console user interface library for Python in versions prior to 4.0.7. The handle_short_request() function unconditionally encodes HTTP POST input as ASCII without exception handling and opens a FIFO pipe file descriptor without a guaranteed cleanup block. Submitting non-ASCII characters triggers an unhandled UnicodeEncodeError that terminates CGI request processing and leaks the open file descriptor. Additionally, the screen update polling routine decodes Unix domain socket streams iteratively as UTF-8 without exception handling or deterministic socket closure, enabling uncaught UnicodeDecodeError exceptions and socket leaks.
3 views•10 min read