CRITICAL9.0CVE-2026-55203HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allo…
LOW1.8A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.
LOW2.2BBOT: Symlink-Following Arbitrary Write via github_workflows Module
LOW3.1BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
LOW3.7Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets.
LOW3.7Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring,…
CRITICAL9.1Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing value…
CRITICAL9.1Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, fo…
CRITICAL9.3Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
CRITICAL9.1Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
CRITICAL9.1Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
CRITICAL9.8Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
LOW3.1Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage…
CRITICAL9.6Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a…
CRITICAL9.8Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
CRITICAL9.1vLLM: OpenAI auth bypass
CRITICAL9.6Langflow: Unauthenticated RCE in Shareable Playgrounds
CRITICAL9.1Mitigation bypass in the DOM: Security component.
CRITICAL9.1Same-origin policy bypass in the Networking: Cookies component.
CRITICAL9.6Sandbox escape due to incorrect boundary conditions in the Networking component.
CRITICAL9.6Sandbox escape in the DOM: Navigation component.
CRITICAL9.6Sandbox escape in the DOM: Workers component.
CRITICAL9.1Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery.
CRITICAL9.1Socket versions before 2.041 for Perl have an out-of-bounds heap read.