๐จ CVE-2026-73566
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.
๐@cveNotify
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.
๐@cveNotify
GitHub
list: prevent unbounded recursion ยท isaacs/node-tar@631ae59
tar for node. Contribute to isaacs/node-tar development by creating an account on GitHub.
๐จ CVE-2026-73567
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by jsbn@1.1.0, which seeds an ARC4 stream from Math.random() and new Date().getTime() because window.crypto.getRandomValues is unavailable even though globalThis.crypto exists. An attacker who can observe the process's Math.random() outputs and estimate the key-generation time can reconstruct the seed, recover generated SM2 private keys, and predict signing ephemeral scalars used to forge signatures. This issue is fixed in version 0.5.0.
๐@cveNotify
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by jsbn@1.1.0, which seeds an ARC4 stream from Math.random() and new Date().getTime() because window.crypto.getRandomValues is unavailable even though globalThis.crypto exists. An attacker who can observe the process's Math.random() outputs and estimate the key-generation time can reconstruct the seed, recover generated SM2 private keys, and predict signing ephemeral scalars used to forge signatures. This issue is fixed in version 0.5.0.
๐@cveNotify
GitHub
feat: replace jsbn random generator ยท JuneAndGreen/sm-crypto@1f9bd7b
ๅฝๅฏ็ฎๆณjs็. Contribute to JuneAndGreen/sm-crypto development by creating an account on GitHub.
๐จ CVE-2026-73568
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.
๐@cveNotify
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review.
๐@cveNotify
GitHub
fix(yamux): reject oversized DATA frames and bound body reads (GHSA-hโฆ ยท libp2p/py-libp2p@146ea87
โฆmj8-5xmh-5573)
๐จ CVE-2026-73569
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
๐@cveNotify
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
๐@cveNotify
GitHub
fix: multiple DOCTYPE are not allowed ยท NaturalIntelligence/fast-xml-parser@4e546e0
Validate XML, Parse XML and Build XML rapidly without C/C++ based libraries and no callback. - fix: multiple DOCTYPE are not allowed ยท NaturalIntelligence/fast-xml-parser@4e546e0
๐จ CVE-2026-73643
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.
๐@cveNotify
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.
๐@cveNotify
GitHub
parser: avoid reparsing flow sequence pair keys ยท nodeca/js-yaml@3e5240f
When a flow sequence item is detected as a key/value pair, wrap the
already parsed key events in a synthetic flow mapping event instead of
rewinding and parsing the key again.
Nested flow sequence...
already parsed key events in a synthetic flow mapping event instead of
rewinding and parsing the key again.
Nested flow sequence...
๐จ CVE-2026-73644
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an authenticated account holding PROXIED_AUTH assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.
๐@cveNotify
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an authenticated account holding PROXIED_AUTH assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.
๐@cveNotify
GitHub
GHSA-p279-2cqp-84jg SASL PLAIN authzid bypassing the proxy ACI scope โฆ ยท OpenIdentityPlatform/OpenDJ@5c32685
โฆcheck
๐จ CVE-2026-73645
OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal _mint operation could fail silently. The wrap and onTransferReceived functions in contracts/token/ERC7984/extensions/ERC7984ERC20Wrapper.sol did not handle that failure, so a user could transfer the underlying token without receiving the corresponding confidential wrapped token. With the default rate(), the wrapper fills after approximately 18.4 trillion tokens, and subsequent wrapping requests can cause loss of funds. This issue is fixed in version 0.3.1.
๐@cveNotify
OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal _mint operation could fail silently. The wrap and onTransferReceived functions in contracts/token/ERC7984/extensions/ERC7984ERC20Wrapper.sol did not handle that failure, so a user could transfer the underlying token without receiving the corresponding confidential wrapped token. With the default rate(), the wrapper fills after approximately 18.4 trillion tokens, and subsequent wrapping requests can cause loss of funds. This issue is fixed in version 0.3.1.
๐@cveNotify
GitHub
Revert when wrapper is full (#268) (#271) ยท OpenZeppelin/openzeppelin-confidential-contracts@c620d43
* Revert when wrapper full
* up
* simplify and add tests
* update docs
* cei
* add doc
* up
* add custom error and fix tests
* comment clarification
* Rename `_checkTotalSupply` to `_check...
* up
* simplify and add tests
* update docs
* cei
* add doc
* up
* add custom error and fix tests
* comment clarification
* Rename `_checkTotalSupply` to `_check...
๐จ CVE-2026-73647
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.
๐@cveNotify
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.
๐@cveNotify
GitHub
Merge commit from fork ยท quasarframework/quasar@d0a95d9
Quasar Framework - Build high-performance VueJS user interfaces in record time - Merge commit from fork ยท quasarframework/quasar@d0a95d9
๐จ CVE-2026-73649
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts remained unfiltered. The getReferences() flow called getAttributes(), whose property access allowed an attacker-controlled template to traverse constructor.constructor to the JavaScript Function constructor. The #set handler validated only the assignment target and did not inspect the right-hand property-read expression, allowing arbitrary shell commands, environment-variable access, cloud-credential access, and internal-network access in the server process. This issue is fixed in version 2.1.7.
๐@cveNotify
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts remained unfiltered. The getReferences() flow called getAttributes(), whose property access allowed an attacker-controlled template to traverse constructor.constructor to the JavaScript Function constructor. The #set handler validated only the assignment target and did not inspect the right-hand property-read expression, allowing arbitrary shell commands, environment-variable access, cloud-credential access, and internal-network access in the server process. This issue is fixed in version 2.1.7.
๐@cveNotify
GitHub
fix: harden prototype path guards ยท shepherdwind/velocity.js@f8e47a6
velocity for js. Contribute to shepherdwind/velocity.js development by creating an account on GitHub.
๐จ CVE-2026-62888
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
๐@cveNotify
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
๐@cveNotify
๐จ CVE-2026-62889
Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
๐@cveNotify
Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
๐@cveNotify
๐จ CVE-2026-62892
Use after free in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.
๐@cveNotify
Use after free in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.
๐@cveNotify
๐จ CVE-2026-62894
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
๐@cveNotify
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
๐@cveNotify
๐จ CVE-2026-62911
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
๐@cveNotify
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
๐@cveNotify
๐จ CVE-2026-62912
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
๐@cveNotify
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
๐@cveNotify
๐จ CVE-2026-62914
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
๐@cveNotify
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
๐@cveNotify
๐จ CVE-2026-63517
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
๐@cveNotify
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
๐@cveNotify
๐จ CVE-2026-63519
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
๐@cveNotify
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
๐@cveNotify
๐จ CVE-2026-63525
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally.
๐@cveNotify
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally.
๐@cveNotify
๐จ CVE-2026-63527
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
๐@cveNotify
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
๐@cveNotify
๐จ CVE-2026-63532
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
๐@cveNotify
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
๐@cveNotify