https://radar.offseq.com/threat/httpbody-versions-before-12301-for-perl-drop-mixed-case-percent-escapes-from-urlencoded-form-cve-2026-5b8cb5206b2c0023 2026-10-28T19:29:56.991Z weekly 0.7 https://radar.offseq.com/threat/httpbody-versions-before-12301-for-perl-lose-track-of-chunk-boundaries-in-chunked-request-bodies-cve-3735e1c6103254d8 2026-10-28T19:29:53.784Z weekly 0.7 https://radar.offseq.com/threat/httpbody-versions-before-12401-for-perl-allow-memory-exhaustion-via-unbounded-buffering-of-cve-2026-c9cec32c6766c4f3 2026-10-28T19:29:50.515Z weekly 0.8 https://radar.offseq.com/threat/mimefieldparamval-versions-before-5521-for-perl-do-not-flag-a-duplicate-boundary-parameter-cve-2026-04b86ced7c8e03ec 2026-10-28T19:29:47.870Z weekly 0.7 https://radar.offseq.com/threat/mimewords-versions-before-5521-for-perl-allow-memory-exhaustion-via-repeated-sequences-in-cve-2026-0a3a65e34b050d68 2026-10-28T19:29:44.240Z weekly 0.8 https://radar.offseq.com/threat/httpbody-versions-before-12301-for-perl-allow-cpu-exhaustion-via-quadratic-regex-backtracking-cve-2026-ea37ae73ef02231f 2026-10-28T19:29:40.934Z weekly 0.8 https://radar.offseq.com/threat/httpbody-versions-before-12401-for-perl-allow-cpu-exhaustion-via-regex-backtracking-on-the-cve-2026-032b3334369721d9 2026-10-28T19:29:37.322Z weekly 0.8 https://radar.offseq.com/threat/mimeparserfileunder-versions-before-5521-for-perl-reuse-a-pre-created-output-directory-and-follow-0367d6c059d51790 2026-10-28T19:29:33.927Z weekly 0.8 https://radar.offseq.com/threat/mimeparser-versions-before-5521-for-perl-set-no-limit-on-the-number-of-message-parts-by-default-cve-0bbc857a2f6a75ed 2026-10-28T19:29:30.661Z weekly 0.7 https://radar.offseq.com/threat/when-eap-runs-with-secmgr-the-openjdk-orbs-jdkbridge-honours-attacker-supplied-cdr-codebase-urls-36a8740aa617ecfe 2026-10-28T19:28:55.608Z weekly 0.8 https://radar.offseq.com/threat/dont-starve-together-steam-appid-322330-through-build-747465-contains-a-memory-corruption-8d7ee0f0e5d30ca7 2026-10-28T19:29:27.196Z weekly 0.7 https://radar.offseq.com/threat/a-user-with-read-access-to-grafanas-server-logs-or-to-a-log-store-they-are-shipped-to-can-recover-the-a72cce422e7625d1 2026-10-28T19:29:23.696Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-115415-cwe-1427-improper-neutralization-of-input-used-for-llm-prompting-in-amazon-strands-f79de6bb16a5e324 2026-10-28T19:43:46.375Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118651-cwe-346-origin-validation-error-in-labstack-echo-458a10e78a1689c6 2026-10-28T19:43:41.673Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118650-cwe-177-improper-handling-of-url-encoding-hex-encoding-in-labstack-echo-f71d83b6ef20e803 2026-10-28T19:43:16.875Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-63190-cwe-306-missing-authentication-for-critical-function-in-fearlessgeekmedia-fearlesscms-09d345d566d5dfa9 2026-10-28T19:43:13.154Z weekly 0.9 https://radar.offseq.com/threat/cve-2026-61542-cwe-306-missing-authentication-for-critical-function-in-drhelius-gearboy-a045c1dc8eb4fe53 2026-10-28T19:59:17.028Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118653-cwe-290-authentication-bypass-by-spoofing-in-labstack-echo-e69da52e641e3bd7 2026-10-28T20:00:32.377Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-54162-cwe-150-improper-neutralization-of-escape-meta-or-control-sequences-in-alexandre-c0426a771820dd95 2026-10-28T20:00:28.012Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-61529-cwe-918-server-side-request-forgery-ssrf-in-endatix-fdd45c66e075a621 2026-10-28T20:00:22.689Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118652-cwe-79-cross-site-scripting-in-labstack-echo-b5a9eeeaa5d7a8d3 2026-10-28T20:00:17.834Z weekly 0.7 https://radar.offseq.com/threat/ikev2-use-after-free-bug-when-using-ike-over-tcp-7c9fe8eb142c671f 2026-10-28T20:00:13.556Z weekly 0.7 https://radar.offseq.com/threat/null-pointer-dereference-in-pkcs7-bundle-with-no-certificates-232d595bd1001506 2026-10-28T20:00:08.802Z weekly 0.7 https://radar.offseq.com/threat/vitess-vttablet-twopcz-reflected-xss-856ccc7c2168ad4a 2026-10-28T20:00:04.375Z weekly 0.7 https://radar.offseq.com/threat/tls-12-session-resumption-in-ssl-crosses-sni-virtual-host-client-certificate-trust-boundaries-e459cc77c317bea3 2026-10-28T19:59:59.813Z weekly 0.7 https://radar.offseq.com/threat/tls-13-client-ticket-store-crashed-by-newsessionticket-with-empty-earlydata-extension-in-ssl-2bfef381d5381f8d 2026-10-28T19:59:55.672Z weekly 0.7 https://radar.offseq.com/threat/cifs-utils-mountcifs-credential-file-option-injection-allows-local-privilege-boundary-bypass-b43547d2b8a9c5b2 2026-10-28T19:59:52.375Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-117574-authorization-bypass-through-user-controlled-key-in-red-hat-red-hat-openshift-ai-rhoai-8cd1286cd4e43076 2026-10-28T20:14:53.993Z weekly 0.9 https://radar.offseq.com/threat/cve-2026-118654-cwe-22-path-traversal-in-labstack-echo-c5fae4ae9b6bbf71 2026-10-28T20:15:22.215Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118655-cwe-174-double-decoding-of-the-same-data-in-labstack-echo-8838edf7ded180b5 2026-10-28T20:15:16.581Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-76418-unchecked-return-value-to-null-pointer-dereference-in-cisco-cisco-secure-firewall-e91e1a1647fdbba8 2026-10-28T20:14:47.216Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-55587-cwe-346-origin-validation-error-in-aliasvault-b0a8f547fb6d40e1 2026-10-28T20:14:41.070Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-13451-server-side-request-forgery-ssrf-in-red-hat-red-hat-openshift-ai-rhoai-19614c3f54d2a7d6 2026-10-28T20:14:35.835Z weekly 0.8 https://radar.offseq.com/threat/echo-bodydump-captures-request-and-response-bodies-without-size-limits-in-v4-cve-2026-118260-1803d53c020bf505 2026-10-28T20:14:28.296Z weekly 0.8 https://radar.offseq.com/threat/echo-decompress-permits-unbounded-gzip-expansion-in-v4-cve-2026-118261-e2f8dcd9d2372e68 2026-10-28T20:14:23.009Z weekly 0.8 https://radar.offseq.com/threat/echo-websocket-proxy-can-retain-connections-and-handlers-after-client-disconnect-cve-2026-118262-d5ebb5d5ad83a754 2026-10-28T20:14:18.280Z weekly 0.8 https://radar.offseq.com/threat/echo-bodydump-can-discard-bodylimit-overflow-errors-for-unknown-length-requests-cve-2026-118263-61bc0ee75fe11df7 2026-10-28T20:15:11.988Z weekly 0.7 https://radar.offseq.com/threat/echo-x-real-ip-extractor-trusts-the-header-value-instead-of-the-sending-peer-cve-2026-118265-d43acf2f843fdd4a 2026-10-28T20:15:05.138Z weekly 0.7 https://radar.offseq.com/threat/echo-rejected-websocket-upgrades-can-bypass-echo-route-level-access-controls-cve-2026-118264-4f12241be37a8e3a 2026-10-28T20:14:13.337Z weekly 0.9 https://radar.offseq.com/threat/v2-caddy-has-an-rfc-7230-61-compliance-issue-hop-by-hop-headers-that-leak-through-cve-2026-55458-38b7dc5d8a2a2160 2026-10-28T20:14:59.610Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118656-cwe-601-open-redirect-in-labstack-echo-31d93ea41afc96e5 2026-10-28T20:30:26.218Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118657-cwe-346-origin-validation-error-in-labstack-echo-b92542776a11d39d 2026-10-28T20:30:22.226Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118658-cwe-601-open-redirect-in-labstack-echo-7febe1d2d5177bf4 2026-10-28T20:30:17.219Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118661-cwe-565-reliance-on-cookies-without-validation-and-integrity-checking-in-capricorn86-d5547fd154c5a881 2026-10-28T20:44:33.957Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118659-cwe-918-server-side-request-forgery-ssrf-in-capricorn86-happy-dom-82a36290b5191bf4 2026-10-28T20:43:39.463Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118660-cwe-918-server-side-request-forgery-ssrf-in-capricorn86-happy-dom-3f9c60ed64f7987c 2026-10-28T20:43:35.063Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118667-cwe-22-path-traversal-in-langchain-ai-langgraph-2416abefc2513c6e 2026-10-28T21:00:15.119Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118665-cwe-613-insufficient-session-expiration-in-ardatan-graphql-tools-1ed85b02ea89e405 2026-10-28T20:59:19.269Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118666-cwe-200-exposure-of-sensitive-information-to-an-unauthorized-actor-in-ardatan-graphql-3e5eb8db875755ba 2026-10-28T21:00:10.440Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118662-cwe-180-incorrect-behavior-order-validate-before-canonicalize-in-vitejs-vite-7cf58801d14b8faa 2026-10-28T21:00:06.892Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118663-cwe-174-double-decoding-of-the-same-data-in-honojs-node-server-b74c4ccfd75b6ac2 2026-10-28T21:00:03.205Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118664-cwe-400-uncontrolled-resource-consumption-in-samverschueren-decode-uri-component-32daeb5d0232e083 2026-10-28T20:59:15.057Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118668-cwe-639-authorization-bypass-through-user-controlled-key-in-langchain-ai-langgraph-api-b1a76c608cfa9eee 2026-10-28T21:06:43.157Z weekly 0.8 https://radar.offseq.com/threat/mysqlconnector-account-password-disclosed-to-a-man-in-the-middle-in-zero-configuration-tls-mode-clear-110a248e1d9fd005 2026-10-28T19:49:44.000Z weekly 0.7 https://radar.offseq.com/threat/rucio-has-an-authorization-bypass-on-rest-api-endpoint-for-signing-urls-cve-2026-58273-09bd098568ade56a 2026-10-28T19:50:05.000Z weekly 0.8 https://radar.offseq.com/threat/mcp-sanitizer-file-path-sanitizer-permits-arbitrary-user-home-absolute-paths-1f04c3c7e2ee970c 2026-10-28T19:51:34.000Z weekly 0.8 https://radar.offseq.com/threat/mcp-sanitizer-url-sanitizer-allows-localhostipv6-loopback-ssrf-bypass-via-explicit-port-or-bracketed-c7db142160cb0742 2026-10-28T19:51:40.000Z weekly 0.8 https://radar.offseq.com/threat/echo-reverse-proxy-forwards-attacker-supplied-x-real-ip-to-upstream-by-default-cve-2026-118651-6cdf5f0b19526173 2026-10-28T19:53:24.000Z weekly 0.7 https://radar.offseq.com/threat/v5-echo-has-csrf-protection-bypass-via-methodoverride-rewriting-post-to-safe-method-cve-2026-118266-32cd2c193e0252bf 2026-10-28T19:53:36.000Z weekly 0.7 https://radar.offseq.com/threat/v5-echo-has-rate-limiter-bypass-via-spoofed-x-forwarded-for-header-in-default-configuration-cve-2026-f41c54201f42dcd6 2026-10-28T19:53:47.000Z weekly 0.7 https://radar.offseq.com/threat/v5-echo-vulnerable-to-reflected-cross-site-scripting-xss-via-unsanitized-jsonp-callback-in-contextjsonp-7617338e77b0d463 2026-10-28T19:54:05.000Z weekly 0.7 https://radar.offseq.com/threat/echos-middlewarestatic-2f-encoded-path-bypasses-routegroup-middleware-guarding-a-statically-served-path-eac4264d1a86a284 2026-10-28T19:54:20.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-core-javascript-url-in-an-xlinkhref-attribute-survives-text-filtering-and-reaches-exported-3d5dca65200e0472 2026-10-28T19:55:10.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-core-html-text-parsing-falls-back-to-unfiltered-innerhtml-during-printing-cve-2026-118244-a4a659f0811779a7 2026-10-28T19:55:23.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-dashboards-proto-data-table-id-writes-sync-listeners-to-objectprototype-cve-2026-118243-033c705ad7c2d940 2026-10-28T19:55:32.000Z weekly 0.7 https://radar.offseq.com/threat/highcharts-dashboards-grid-pro-datatablesetcell-and-column-writers-treat-proto-as-an-cve-2026-118247-dde6a242cedab43f 2026-10-28T19:55:37.000Z weekly 0.7 https://radar.offseq.com/threat/highcharts-dashboards-chartconstructor-is-an-unchecked-lookup-into-the-highcharts-namespace-cve-2026-b3b94e68a5ff5521 2026-10-28T19:55:41.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-grid-custom-icon-definition-objects-written-with-raw-setattribute-on-path-cve-2026-118242-5cfb9192c808c603 2026-10-28T19:55:46.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-grid-pro-cell-renderer-attributes-map-written-with-raw-setattribute-cve-2026-116797-a957edf529650c2d 2026-10-28T19:56:03.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-core-breadcrumbsstyle-keys-become-svg-event-handler-attributes-cve-2026-118246-50c9aec95dbff5bf 2026-10-28T19:56:07.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-series-column-construction-writes-to-objectprototype-cve-2026-118249-b71d74550589237d 2026-10-28T19:56:13.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-dotted-serieskeys-paths-write-to-objectprototype-cve-2026-118250-81b2869a06c8cf78 2026-10-28T19:56:18.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-javascript-url-in-creditshref-runs-script-on-click-cve-2026-118251-8cc21b5190931e4f 2026-10-28T19:56:36.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-dashboards-parses-sidebar-component-labels-as-html-cve-2026-118252-20fba20ceb5fdcf1 2026-10-28T19:56:57.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-dashboards-parses-fullscreen-labels-as-html-cve-2026-118253-5f1ca418bd11c1de 2026-10-28T19:57:20.000Z weekly 0.8 https://radar.offseq.com/threat/grid-lite-highcharts-grid-parses-pagination-language-options-as-html-cve-2026-118254-9e8c8124962a67b8 2026-10-28T19:57:34.000Z weekly 0.8 https://radar.offseq.com/threat/highcharts-grid-javascript-url-in-creditshref-runs-script-on-click-cve-2026-118255-0cc4fdaf7210eb0b 2026-10-28T19:57:48.000Z weekly 0.8 https://radar.offseq.com/threat/malicious-code-in-itsa-utils-npm-06c5949afc477309 2026-10-28T21:16:55.345Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118804-missing-authorization-in-bricks-bricks-builder-82c7a71ea0160b41 2026-10-28T21:29:36.227Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118669-cwe-863-incorrect-authorization-in-oauthlib-e992e47d2a14b549 2026-10-28T21:29:32.320Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118682-improper-certificate-validation-in-karingx-clashmi-0cf41be86b7a26a7 2026-10-28T21:29:27.917Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118689-allocation-of-resources-without-limits-or-throttling-in-ovenmedialabs-ovenmediaengine-d7227961e590e89d 2026-10-28T21:29:00.906Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118690-missing-authentication-for-critical-function-in-signalk-signalk-server-738ce5971bdaf562 2026-10-28T21:28:57.322Z weekly 0.9 https://radar.offseq.com/threat/cve-2026-118691-initialization-of-a-resource-with-an-insecure-default-in-gudong2003-xianyu-auto-reply-211f1805ed4f6ad5 2026-10-28T21:29:23.215Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118692-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-1db1599ff3f6e4b9 2026-10-28T21:28:53.582Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118693-absolute-path-traversal-in-giuspen-cherrytree-195468ac269d28ae 2026-10-28T21:29:19.855Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118694-inefficient-algorithmic-complexity-in-trentm-python-markdown2-9eb35417d5c7b6a6 2026-10-28T21:28:49.711Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118752-out-of-bounds-write-in-danoli3-freeimage-8f80334419cc396a 2026-10-28T21:28:46.513Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118753-out-of-bounds-write-in-danoli3-freeimage-5378e97bc62f9189 2026-10-28T21:28:43.046Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118754-missing-authorization-in-dolibarr-dolibarr-erpcrm-53ce25a111d70c7d 2026-10-28T21:29:14.116Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118755-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-e31170e6a9f34d94 2026-10-28T21:28:39.559Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118756-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-gopasspw-6af745a20bbc7018 2026-10-28T21:29:08.750Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118757-missing-authorization-in-pi-websolution-piweb-disable-payment-method-partial-payment-15a6344bd00c4f26 2026-10-28T21:29:04.857Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-118803-improper-neutralization-of-special-elements-used-in-a-template-engine-in-bricks-bricks-bebe5a18a6d191d2 2026-10-28T21:28:36.013Z weekly 0.8 https://radar.offseq.com/threat/managed-for-malice-how-attackers-turn-mdm-into-remote-access-5b1580c41d0164f3 2026-10-28T21:59:25.588Z weekly 0.7 https://radar.offseq.com/threat/false-protection-emptied-accounts-the-seven-android-trojan-families-targeting-indian-banking-apps-ffb0eea070bf7b53 2026-10-28T21:59:21.543Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-116641-cwe-295-improper-certificate-validation-in-mongodb-database-tools-bbf526e0035199d2 2026-10-28T21:59:02.612Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-54453-cwe-74-injection-in-opencats-opencats-55c5347edae9b390 2026-10-28T21:58:46.653Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-61571-cwe-306-missing-authentication-for-critical-function-in-wwbn-avideo-encoder-43167897f374cb01 2026-10-28T21:58:42.493Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-118537-improper-input-validation-in-a2ui-ffdf4bda89a04cd7 2026-10-28T21:58:58.751Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-54455-cwe-20-improper-input-validation-in-opencats-opencats-b3b817e8e06519fd 2026-10-28T21:58:38.474Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-61564-cwe-94-code-injection-in-wwbn-avideo-encoder-a58d1755eccf759b 2026-10-28T21:58:34.342Z weekly 0.9 https://radar.offseq.com/threat/cve-2026-61567-cwe-78-os-command-injection-in-wwbn-avideo-encoder-ceb4468e77086efa 2026-10-28T21:58:29.949Z weekly 0.9 https://radar.offseq.com/threat/cve-2026-61572-cwe-918-server-side-request-forgery-ssrf-in-wwbn-avideo-encoder-cac5634e75143295 2026-10-28T21:58:25.283Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-61573-cwe-79-cross-site-scripting-in-wwbn-avideo-encoder-19a5fb38b3e7ac6a 2026-10-28T21:58:54.999Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-57448-cwe-918-server-side-request-forgery-ssrf-in-mrblomblo-blombooru-a8a4ded90968979c 2026-10-28T21:58:50.460Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-61546-cwe-346-origin-validation-error-in-ankimcp-anki-mcp-server-addon-5ea3f0850d047308 2026-10-28T21:58:20.393Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-93851-cwe-22-path-traversal-in-mattermost-27710a7fa379d829 2026-10-28T21:58:16.383Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-61569-cwe-89-sql-injection-in-wwbn-avideo-encoder-fd8dd62fb0d7d343 2026-10-28T21:54:38.358Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-61575-cwe-79-cross-site-scripting-in-wwbn-avideo-encoder-f2b4ebf3f491f2a3 2026-10-28T21:57:55.205Z weekly 0.7 https://radar.offseq.com/threat/malicious-code-in-zaip-aicli-npm-48bfe6d7a84435a7 2026-10-28T20:40:54.000Z weekly 0.7 https://radar.offseq.com/threat/v5-echo-has-arbitrary-scheme-injection-in-wwwredirectnonwwwredirect-middlewares-via-x-forwarded-proto-03a3119a1691800f 2026-10-28T21:04:10.000Z weekly 0.7 https://radar.offseq.com/threat/v5-echo-has-open-redirect-via-control-character-prefix-defeating-sanitizeuri-cve-2026-118656-11c704e78bf7d428 2026-10-28T21:04:22.000Z weekly 0.7 https://radar.offseq.com/threat/v5-echo-has-a-static-middleware-double-unescape-path-traversal-cve-2026-118655-bafae3aecf023339 2026-10-28T21:04:39.000Z weekly 0.7 https://radar.offseq.com/threat/v5-echo-static-file-middleware-route-protection-bypass-via-encoded-dot-dot-traversal-cve-2026-118654-cd48790ae054107a 2026-10-28T21:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/echo-https-redirect-and-hsts-bypass-via-unconditional-trust-of-forwarded-scheme-headers-cve-2026-118657-966639021ac2890b 2026-10-28T21:04:52.000Z weekly 0.7 https://radar.offseq.com/threat/hononode-server-servestatic-decodes-the-request-path-a-second-time-leading-to-bypass-of-middleware-on-a0b0b410c0410de3 2026-10-28T21:05:00.000Z weekly 0.7 https://radar.offseq.com/threat/graphql-tools-shared-legacy-executor-routes-one-subscriptions-results-to-a-different-caller-cve-2026-c86be437ca93c226 2026-10-28T21:05:08.000Z weekly 0.7 https://radar.offseq.com/threat/graphql-tools-per-request-connection-parameters-persist-into-later-users-websocket-authentications-cve-9407362799762447 2026-10-28T21:05:17.000Z weekly 0.8 https://radar.offseq.com/threat/langgraph-unencoded-identifiers-in-langgraph-sdk-v3-streaming-can-redirect-authenticated-get-requests-1bfd13060ff126ce 2026-10-28T21:05:47.000Z weekly 0.7 https://radar.offseq.com/threat/happy-dom-has-cookie-scope-forgery-no-dns-label-boundary-on-domain-matching-attacker-origin-sets-d82d80758cdb0d7d 2026-10-28T21:06:13.000Z weekly 0.7 https://radar.offseq.com/threat/vue-i18n-escapeparameter-does-not-prevent-xss-through-srcdoc-in-translation-messages-cve-2026-118257-831c2e60bc3e563c 2026-10-28T21:06:24.000Z weekly 0.8 https://radar.offseq.com/threat/vue-i18n-escapeparameter-does-not-escape-named-values-when-the-same-call-also-passes-a-list-cve-2026-af5a531453cf237f 2026-10-28T21:06:34.000Z weekly 0.7 https://radar.offseq.com/threat/happy-dom-ssrf-via-iframe-and-link-stylesheet-when-parsing-untrusted-html-cve-2026-118660-15c62b16c5ca553d 2026-10-28T21:06:42.000Z weekly 0.8 https://radar.offseq.com/threat/nodejs-whisper-allows-os-command-injection-through-crafted-audio-file-paths-cve-2026-110644-48836413e3038093 2026-10-28T21:06:52.000Z weekly 0.9 https://radar.offseq.com/threat/opentelemetry-java-quadratic-cpu-consumption-in-w3c-tracestate-parsing-cve-2026-118259-add3212d11c3af2c 2026-10-28T21:07:40.000Z weekly 0.7 https://radar.offseq.com/threat/langgraph-api-relative-webhook-targets-in-langgraph-server-can-reach-in-process-routes-without-d459f54a8a50f0af 2026-10-28T21:07:56.000Z weekly 0.7 https://radar.offseq.com/threat/i18next-http-backend-namespace-value-starting-with-forms-a-protocol-relative-url-when-loadpathaddpath-ec0e672f5a0f5135 2026-10-28T21:07:57.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-e286a07bdec5de1f 2026-10-28T21:08:08.000Z weekly 0.7 https://radar.offseq.com/threat/langgraph-api-incomplete-assistant-authorization-in-langgraph-server-run-creation-cve-2026-55236-01c38b80f5cf0d54 2026-10-28T21:08:12.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-af9aba769acad39a 2026-10-28T21:08:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-7aa5a73121607304 2026-10-28T21:08:23.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-cb3553197c3dd17a 2026-10-28T21:08:30.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-c80c26086806a213 2026-10-28T21:08:35.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-8a935c03d3056422 2026-10-28T21:08:40.000Z weekly 0.7 https://radar.offseq.com/threat/langgraph-checkpoint-sqlite-langgraph-sqlite-checkpoint-filter-key-sql-injection-poc-for-sqlitestore-ff336c870801899d 2026-10-28T21:08:43.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-dd7f6f23014f329e 2026-10-28T21:08:45.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-993536143abacb73 2026-10-28T21:08:49.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-windowsfilelock-ignores-mode-a-0o600-lock-file-and-the-readwritelock-database-inherit-the-5e066f526c16f7b7 2026-10-28T21:08:55.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-7a70870da364cca8 2026-10-28T21:08:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-d60c8333995ee4d8 2026-10-28T21:09:04.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-b3e976a6791501d0 2026-10-28T21:09:09.000Z weekly 0.7 https://radar.offseq.com/threat/langgraph-api-langgraph-javascript-custom-authentication-may-permit-cross-user-store-access-cve-2026-829786eb5c8297cb 2026-10-28T21:09:42.000Z weekly 0.8 https://radar.offseq.com/threat/zip-critical-parser-differential-security-control-bypass-via-dual-header-inconsistencies-zip-cloaking-a8a266279cabd7fb 2026-10-28T21:09:51.000Z weekly 0.9 https://radar.offseq.com/threat/re2js-quadratic-time-denial-of-service-in-re2js-lookbehind-matching-cve-2026-116795-4356da9bc4d6bfbf 2026-10-28T21:10:01.000Z weekly 0.8 https://radar.offseq.com/threat/i18next-http-backend-query-parameter-injection-through-and-in-lng-when-loadpathaddpath-puts-lng-in-the-90f291ffd3cf557d 2026-10-28T21:10:08.000Z weekly 0.7 https://radar.offseq.com/threat/autobahn-python-permessage-brotli-inflates-a-whole-frame-before-maxmessagepayloadsize-is-checked-5e9f60e81d1d1c7c 2026-10-28T21:10:17.000Z weekly 0.7 https://radar.offseq.com/threat/graphql-scalars-phonenumber-scalar-is-vulnerable-to-regular-expression-denial-of-service-cve-2026-aad4a5a90c349cb5 2026-10-28T21:13:10.000Z weekly 0.8 https://radar.offseq.com/threat/langgraph-cli-prints-the-registry-push-token-in-langgraph-deploy-verbose-output-cve-2026-115885-cef1036f667bfc34 2026-10-28T21:13:18.000Z weekly 0.7 https://radar.offseq.com/threat/systeminformation-has-prototype-pollution-in-networkstats-via-the-interface-name-cve-2026-116674-760a0370a9593461 2026-10-28T21:13:32.000Z weekly 0.7 https://radar.offseq.com/threat/systeminformation-has-path-traversal-in-linux-networkstats-that-allows-symlink-based-file-disclosure-904b2d4d3b656ce6 2026-10-28T21:13:50.000Z weekly 0.7 https://radar.offseq.com/threat/go-jose-panic-during-cbc-hmac-processing-cve-2026-116585-e5cf0899e07d4655 2026-10-28T21:14:00.000Z weekly 0.7 https://radar.offseq.com/threat/go-jose-panics-in-json-parsing-cve-2026-116586-20a3136dafd51ede 2026-10-28T21:14:08.000Z weekly 0.7 https://radar.offseq.com/threat/wasmtime-cranelift-backend-on-aarch64-can-jump-to-incorrect-target-on-large-wasm-brtable-instruction-ac08436b3c57d22d 2026-10-28T21:14:15.000Z weekly 0.9 https://radar.offseq.com/threat/vllm-dos-via-unbounded-chattemplate-jinja2-rendering-exhausts-the-renderer-thread-pool-cve-2026-115911-2fd63652d309d528 2026-10-28T21:14:52.000Z weekly 0.7 https://radar.offseq.com/threat/vllm-responses-api-bypasses-trustrequestchattemplate-for-chattemplatekwargs-cve-2026-115918-5839ecae143f4872 2026-10-28T21:14:59.000Z weekly 0.7 https://radar.offseq.com/threat/vllm-out-of-vocabulary-prompt-token-id-passes-input-validation-and-triggers-a-cuda-device-side-assert-661f36cea004f4ad 2026-10-28T21:15:08.000Z weekly 0.7 https://radar.offseq.com/threat/vllm-public-multimodal-shm-handle-forgery-reaches-worker-side-pickleloads-with-insecure-serialization-07a101a07172922e 2026-10-28T21:15:15.000Z weekly 0.8 https://radar.offseq.com/threat/vllm-untrusted-eps-inputs-can-trigger-denial-of-service-or-ghostscript-rce-cve-2026-115915-aaa0cd71e07b21bd 2026-10-28T21:15:29.000Z weekly 0.8 https://radar.offseq.com/threat/vllm-deepseek-ocr-image-processing-vulnerable-to-denial-of-service-cve-2026-115914-ecfa7103eac993b5 2026-10-28T21:15:35.000Z weekly 0.7 https://radar.offseq.com/threat/vllm-phi-4-multimodal-audio-encoder-materializes-and-retains-full-attention-matrices-a-single-max-480f0a4b0d6ced42 2026-10-28T21:15:41.000Z weekly 0.7 https://radar.offseq.com/threat/vllm-permissive-default-cors-origins-allow-cross-origin-requests-to-the-vllm-http-server-cve-2026-575fb9b0f5462021 2026-10-28T21:15:50.000Z weekly 0.7 https://radar.offseq.com/threat/onnx-out-of-bounds-read-in-rnngrulstm-shape-inference-old-opsets-missing-rank-check-cve-2026-115919-3a2cacf475826da3 2026-10-28T21:16:24.000Z weekly 0.7 https://radar.offseq.com/threat/onnx-null-pointer-dereference-in-scaninferencefunction-due-to-missing-required-attribute-cve-2026-8c1ee5eb8ddab136 2026-10-28T21:16:30.000Z weekly 0.7 https://radar.offseq.com/threat/onnx-denial-of-service-via-unchecked-expansion-of-packed-sub-byte-tensors-in-onnx-python-apis-cve-2026-54782d7aefcfdd8d 2026-10-28T21:16:38.000Z weekly 0.7 https://radar.offseq.com/threat/onnx-out-of-bounds-read-in-convtranspose-shape-inference-via-undersized-weight-rank-cve-2026-115920-54c6541a946e69a5 2026-10-28T21:16:42.000Z weekly 0.7 https://radar.offseq.com/threat/python-social-auth-openid-connect-nonce-is-not-bound-to-the-browser-session-so-a-stolen-authorization-443ced198e5f1f4d 2026-10-28T21:16:51.000Z weekly 0.7 https://radar.offseq.com/threat/mem0-cross-tenant-conversation-leak-via-unescaped-delimiter-collision-in-session-scope-key-e7ce302a5c7cb372 2026-10-28T21:17:08.000Z weekly 0.7 https://radar.offseq.com/threat/seroval-deserialization-invokes-attacker-chosen-callables-asynciteratorfactoryinstance-calls-49af2ec69a109239 2026-10-28T21:17:15.000Z weekly 0.8 https://radar.offseq.com/threat/seroval-fromjsonfromcrossjson-denial-of-service-via-unvalidated-array-node-length-cve-2026-116584-a0b27579e0ee91fe 2026-10-28T21:17:21.000Z weekly 0.8 https://radar.offseq.com/threat/seroval-fromjson-deserializer-trusts-node-supplied-array-length-and-sequence-doneat-unauthenticated-092a8a66a7685b53 2026-10-28T21:17:27.000Z weekly 0.8 https://radar.offseq.com/threat/seroval-script-injection-through-regexp-sources-in-serialized-output-cve-2026-116582-56f8bc44ad524e3d 2026-10-28T21:17:31.000Z weekly 0.7 https://radar.offseq.com/threat/seroval-code-injection-through-a-typed-arrays-own-constructor-property-cve-2026-116583-58c9858943d78456 2026-10-28T21:17:36.000Z weekly 0.7 https://radar.offseq.com/threat/vercel-waline-login-accepts-a-non-string-email-as-a-match-all-mongodb-query-c383dd4b776b7b58 2026-10-28T21:17:58.000Z weekly 0.7 https://radar.offseq.com/threat/knativedevpkg-admission-webhooks-allow-unbounded-request-body-memory-exhaustion-6d21c45562558da6 2026-10-28T21:20:54.000Z weekly 0.7 https://radar.offseq.com/threat/electrum-malicious-server-can-replace-a-just-broadcast-tx-and-try-to-trick-user-into-rbf-ing-it-cve-bd7d466b0e25820a 2026-10-28T21:23:44.000Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-46300-net-skbuff-preserve-shared-frag-marker-during-coalescing-in-linux-kernel-5d4c52c059ee9421 2026-10-28T21:30:44.000Z weekly 0.8 https://radar.offseq.com/threat/vmware-esx-contains-an-insufficient-logging-vulnerability-cve-2026-41709-057ab81cb6ae517d 2026-10-28T21:30:47.000Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-74580-vhost-reset-the-vring-metadata-cache-on-vring-reconfiguration-in-linux-kernel-06f471de471addbb 2026-10-28T21:30:50.000Z weekly 0.8 https://radar.offseq.com/threat/a-flaw-was-found-in-flatpak-builder-where-git-hooks-are-not-disabled-when-applying-patch-sources-with-766364e38f2e73f8 2026-10-28T21:30:50.000Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-98097-tipc-dont-send-random-pad-bytes-in-resetactivate-messages-in-linux-kernel-3452ad6014fdd131 2026-10-28T21:30:51.000Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-98099-ipv6-mcast-use-rcuassignpointer-for-rcu-list-updates-in-linux-kernel-8db2125138eb912a 2026-10-28T21:30:51.000Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-98110-bluetooth-btintel-bound-firmware-id-by-tlv-length-in-linux-kernel-9efd9db24a65b845 2026-10-28T21:30:51.000Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-98111-bluetooth-btintel-validate-version-tlv-value-lengths-in-linux-kernel-cc83c8c3552a9add 2026-10-28T21:30:51.000Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-98098-tipc-fix-null-deref-in-tipcnamednodeup-on-empty-publication-list-in-linux-kernel-ca34bc98b02ee8c7 2026-10-28T21:30:51.000Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-98113-ksmbd-rate-limit-unmapped-sid-errors-in-linux-kernel-ad7d8c1c2c2ea585 2026-10-28T21:30:51.000Z weekly 0.7 https://radar.offseq.com/threat/insufficient-policy-enforcement-in-chrome-devtools-mcp-in-google-chrome-on-linux-prior-to-150-allowed-ec6dbf8921cc8360 2026-10-28T21:31:14.000Z weekly 0.7 https://radar.offseq.com/threat/n8n-before-112385-2435-and-2441-contains-a-credential-guard-bypass-vulnerability-that-allows-editors-a1e6cbcf442d895f 2026-10-28T21:31:15.000Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-2435-and-244x-before-2441-accepts-a-client-supplied-workflow-id-and-caches-each-workflows-f94b32ebab705933 2026-10-28T21:31:15.000Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-112385-2435-and-2441-contains-a-regular-expression-denial-of-service-vulnerability-that-23e6cff5a975037c 2026-10-28T21:31:15.000Z weekly 0.7 https://radar.offseq.com/threat/n8n-before-112385-2x-before-2435-and-244x-before-2441-contains-a-filter-injection-vulnerability-in-the-d1a3fcdca35f5265 2026-10-28T21:31:15.000Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-112385-2435-and-2441-contains-an-authorization-bypass-vulnerability-that-allows-member-eef00ca3aa1e1266 2026-10-28T21:31:15.000Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-112385-2435-and-2441-contains-an-authorization-bypass-vulnerability-in-chat-hub-that-allows-307632628bbe81ea 2026-10-28T21:31:15.000Z weekly 0.7 https://radar.offseq.com/threat/n8n-before-2415-and-242x-before-2422-passes-a-failed-workflows-full-execution-context-including-the-b4fee91166e485ce 2026-10-28T21:31:15.000Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-112385-2x-before-2435-and-244x-before-2441-stores-credential-secrets-in-execution-error-data-882e4dc5a71b9139 2026-10-28T21:31:15.000Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-112385-2x-before-2435-and-244x-before-2441-saves-the-seatable-trigger-nodes-api-token-in-e48a733c299ad96a 2026-10-28T21:31:15.000Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-112385-2x-before-2435-and-244x-before-2441-contains-a-stored-cross-site-scripting-23ae184f20c359ce 2026-10-28T21:31:15.000Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-112385-2x-before-2435-and-244x-before-2441-contains-an-odata-filter-injection-vulnerability-c98941967e65f998 2026-10-28T22:15:06.766Z weekly 0.8 https://radar.offseq.com/threat/a-path-traversal-vulnerability-allows-a-remote-unauthenticated-attacker-to-execute-arbitrary-code-as-6c7fda8453a47065 2026-10-28T22:15:03.033Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-112385-2435-and-2441-contains-an-authorization-bypass-vulnerability-that-allows-c776fb942f784037 2026-10-28T22:14:59.951Z weekly 0.8 https://radar.offseq.com/threat/monai-from-120-before-161-contains-a-remote-code-execution-vulnerability-in-configworkflowinit-which-69a7a83c6ad6d2c2 2026-10-28T22:14:55.730Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-2414-and-242x-before-2421-contains-a-prototype-pollution-vulnerability-that-allows-low-2a783899315aa90a 2026-10-28T22:14:51.814Z weekly 0.8 https://radar.offseq.com/threat/monai-before-161-contains-an-insufficient-integrity-verification-vulnerability-in-checkhash-that-2563c9d532860fe4 2026-10-28T22:14:48.107Z weekly 0.7 https://radar.offseq.com/threat/siyuan-387-through-388-fails-to-normalize-windows-globalroot-device-namespace-aliases-bypassing-cve-ce6c09e7235a117f 2026-10-28T22:14:44.580Z weekly 0.7 https://radar.offseq.com/threat/tooljet-from-3202-lts-before-320242-lts-contains-an-authorization-bypass-in-signupdisableguard-which-70b61d795be19e9c 2026-10-28T22:14:40.929Z weekly 0.7 https://radar.offseq.com/threat/coder-before-22921-2300-before-23412-2350-before-2359-2360-before-2367-and-2370-before-2374-does-1c8a58a0ca7fe69e 2026-10-28T22:14:35.973Z weekly 0.7 https://radar.offseq.com/threat/espocrm-before-9311-and-10x-before-1008-contains-a-denial-of-service-vulnerability-in-which-the-e174ebefbab3b23d 2026-10-28T22:14:30.817Z weekly 0.8 https://radar.offseq.com/threat/n8n-before-2414-and-242x-before-2421-contains-a-missing-confirmation-vulnerability-in-the-local-990b9b69c56dec6b 2026-10-28T22:14:27.500Z weekly 0.7 https://radar.offseq.com/threat/go-chi-chi-before-550-contains-an-authentication-bypass-in-middlewaresupressnotfound-which-calls-match-5412de34ce32d285 2026-10-28T22:14:23.135Z weekly 0.7 https://radar.offseq.com/threat/n8n-before-112383-2414-and-2421-contains-a-server-side-request-forgery-vulnerability-in-the-slack-825f126e37f5d764 2026-10-28T22:14:19.960Z weekly 0.8 https://radar.offseq.com/threat/a-flaw-was-found-in-ai-gateway-payload-processing-cve-2026-117574-dea4d3bf7326f5c3 2026-10-28T22:14:15.774Z weekly 0.9 https://radar.offseq.com/threat/wasmtime-wasi-in-wasmtime-before-36018-3700-before-4806-and-4900-before-4903-re-appends-a-trailing-106a5141c10ae35c 2026-10-28T22:14:00.158Z weekly 0.8 https://radar.offseq.com/threat/a-flaw-was-found-in-kserve-a-namespace-scoped-user-with-createupdate-permissions-on-inferenceservice-cfabbc589492c988 2026-10-28T22:13:55.155Z weekly 0.8 https://radar.offseq.com/threat/the-authentication-endpoint-generates-an-error-message-that-includes-reflected-data-directly-from-the-dc2a3cfa9367ddcf 2026-10-28T22:14:10.632Z weekly 0.7 https://radar.offseq.com/threat/due-to-the-improper-implementation-of-access-control-rules-the-wso2-product-accepts-user-supplied-ecd0fe8f63ab359e 2026-10-28T22:13:50.241Z weekly 0.8 https://radar.offseq.com/threat/an-access-control-bypass-flaw-was-found-in-sambas-vfscephrgw-module-in-its-openat-function-cve-2026-ac2a9b2d634a53d4 2026-10-28T22:13:47.119Z weekly 0.8 https://radar.offseq.com/threat/a-vulnerability-in-the-remote-access-ssl-vpn-service-of-cisco-secure-firewall-adaptive-security-c5ce2a9b84b43bed 2026-10-28T22:13:38.962Z weekly 0.8 https://radar.offseq.com/threat/the-bpmn-system-rest-apis-do-not-sufficiently-validate-input-parameters-allowing-authenticated-users-ada8d66267d5bb5c 2026-10-28T22:13:35.507Z weekly 0.8 https://radar.offseq.com/threat/when-the-allowedscopes-configuration-is-enabled-the-oauth2-token-introspection-mechanism-does-not-c362a66ebc3edef0 2026-10-28T22:14:07.442Z weekly 0.7 https://radar.offseq.com/threat/in-deployments-of-wso2-identity-server-configured-with-a-case-insensitive-user-store-and-a-case-6ef1151c9b415ba3 2026-10-28T22:13:31.845Z weekly 0.8 https://radar.offseq.com/threat/cisco-catalyst-sd-wan-controller-authentication-bypass-vulnerability-dde705954abc8f87 2026-10-28T22:14:03.902Z weekly 0.8