📰 Dev.to · CVE Reports

CVE-2024-29203: CVE-2024-29203: Client-Side Cross-Site Scripting via Unsandboxed Iframes and Legacy Embed Elements in TinyMCE

CVE-2022-0492: CVE-2022-0492: Privilege Escalation and Container Escape via cgroups v1 release_agent

GHSA-JQQ5-8PX3-9M6M: GHSA-JQQ5-8PX3-9M6M: Single-Byte Heap Overflow Bypass in ImageMagick JSON and YAML Encoders

GHSA-VF33-6R7X-66XX: GHSA-VF33-6R7X-66XX: Division by Zero and Integer Overflow in ImageMagick Morphology

GHSA-QV2Q-C278-PCH5: GHSA-qv2q-c278-pch5: Cryptographic Nonce Reuse and Information Disclosure in ImageMagick

CVE-2026-42899: CVE-2026-42899: Denial of Service via Infinite Loops in ASP.NET Core Subsystems

GHSA-FVH2-GM75-J4J7: CVE-2026-42559: DNS Rebinding and CSRF in Model Context Protocol (MCP) HTTP Transport

GHSA-C55G-RP4X-FX84: GHSA-C55G-RP4X-FX84: Integer Overflow and Out-of-Bounds Access in DirectX Tool Kit SpriteFont Parser

GHSA-5R97-79VW-QVM4: GHSA-5r97-79vw-qvm4: Integer Overflow and Memory Corruption in Microsoft DirectXTK12 SpriteFont Parser

CVE-2026-6402: CVE-2026-6402: Cross-Origin Source Code Exposure in webpack-dev-server

GHSA-97R8-RF7Q-WMJW: GHSA-97R8-RF7Q-WMJW: Stored Cross-Site Scripting via Sanitize-then-Decode Flaw in Sveltia CMS

GHSA-WXW3-Q3M9-C3JR: GHSA-WXW3-Q3M9-C3JR: Login CSRF via Insufficient OAuth State Verification in Better Auth

GHSA-VFVV-C25P-M7MM: GHSA-VFVV-C25P-M7MM: Memory Corruption via Panic Safety Flaw in rkyv Collections

GHSA-QXVM-R42F-5P8J: GHSA-QXVM-R42F-5P8J: Authentication Bypass via Meet Plugin in AVideo

CVE-2026-46383: CVE-2026-46383: Arbitrary File Overwrite via Path Traversal (TarSlip) in Microsoft APM

GHSA-MXG3-432P-MR72: GHSA-MXG3-432P-MR72: SSH Host Key Verification Disabled in goshs

CVE-2026-23899: CVE-2026-23899: Improper Access Check in Joomla! com_config Webservices

GHSA-F3CJ-J4F6-WQ85: GHSA-f3cj-j4f6-wq85: Server-Side Rendering Cross-Site Scripting in Svelte hydratable Promises

GHSA-WF8Q-WVV8-P8JF: GHSA-WF8Q-WVV8-P8JF: Unauthenticated User Impersonation in MCPHub SSE Endpoint

GHSA-GXHX-2686-5H9G: GHSA-gxhx-2686-5h9g: Signature Verification Bypass in slack-go via Empty SecretsVerifier

GHSA-7G73-99R4-M4MJ: GHSA-7G73-99R4-M4MJ: Credential Data Leak in FlowiseAI API Responses

CVE-2026-42945: CVE-2026-42945: Heap-based Buffer Overflow in NGINX ngx_http_rewrite_module

GHSA-VW82-7FV8-R6GP: GHSA-vw82-7fv8-r6gp: Authorization Bypass in Obot MCP Gateway via Insecure Route Configuration

CVE-2026-45091: CVE-2026-45091: Cleartext TOTP Secret Exposure in sealed-env JWS Tokens