CVE Watch23 de out. de 2026

CVE-2026-45819

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trig

CVSS

—

Sem CVSS

EPSS

0.5%

p43

KEV

—

Exploit Today

0-100

Publicado: 13 de ago. de 2026 · Última mod.: 23 de out. de 2026 · CWE-705 · CWE-755

EPSS · 30d

0.5%EPSS · 30 dias0.5%

2026-10-102026-11-07

Descrição técnica

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1235557.5 ALT

—

———Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync.5h CVE-2026-73860—

2.6%

——1CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can keep an rseq critical section armed over that injection point so the kernel's restartable-sequence abort redirects execution to an attacker-controlled callback when CRIU resumes the process. In container snapshot environments, the hijacked parasite runs with seccomp disabled and a relaxed AppArmor profile and supplies trusted data to the privileged CRIU process, which can enable higher-privilege code execution. This issue is fixed in version 4.2.1.1d CVE-2026-1202225.9 MÉD

23.8%

——7undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values), a throw raised asynchronously while a cached response is replayed escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can crash any such client by serving a cacheable response that triggers the throw on replay, including on a 304 revalidation of a stale entry, so the impact is availability only. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, avoid composing the cache interceptor with a response handler that throws during response processing until upgrading.1d CVE-2026-100300—

42.0%

——13Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable. This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.4d CVE-2026-1203417.3 ALT

41.3%

——12A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project. Impacted is an unknown function of the file studentdetails.php. The manipulation leads to execution after redirect. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.3d CVE-2026-670806.5 MÉD

27.2%

——8HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths, potentially facilitating further attacks.2d