By weakness (CWE)

CWE-436: related vulnerabilities

CVEs classified under CWE-436. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

10 published vulnerabilities

• CVE-2026-48788HIGH 8.2

  Remark42, a self-hosted comment engine, contains a Cross-Site Scripting (XSS) vulnerability in versions 1.6.0 through 1.15.0 that allows attackers to inject malicious JavaScript into victims' browsers. The vulnerability stems from inconsistent validation in Remark42's image proxy feature. When an attacker hosts a URL that claims to be an image (via Content-Type header) but actually contains HTML or JavaScript, the proxy accepts and re-serves it from Remark42's own origin, tricking browsers into executing the malicious code. Critically, no Remark42 account is required to exploit this—an attacker simply needs to trick a user into clicking a link pointing to their malicious content.

• CVE-2026-13676HIGH 7.5

  fast-uri, a popular Node.js URL parsing library, contains a flaw in how it handles internationalized domain names (IDN) written in Unicode characters. When applications use fast-uri to enforce security policies—such as blocking certain hosts, restricting outbound traffic, or validating redirect destinations—the library fails to convert Unicode hostnames to their standard ASCII form. This mismatch means an attacker could craft a URL with Unicode characters that passes your security checks but resolves to a different host when the actual request is made using Node's standard URL parser or the fetch API. The vulnerability affects versions 2.3.1 through 3.1.2 in the 3.x branch, and 4.0.0 in the 4.x branch.

• CVE-2026-56669HIGH 7.5

  Elysia, a TypeScript framework for building and validating web services, contains a performance flaw in how it processes file upload forms. When handling multipart/form-data requests (the standard for file uploads), the framework uses an inefficient algorithm that causes CPU usage to spike dramatically as more form fields are submitted. An attacker can exploit this by sending a request with many form fields, forcing the server to consume excessive CPU resources and become unresponsive. This is a denial-of-service vulnerability that requires no authentication and can be triggered remotely.

• CVE-2026-42462HIGH 7.0

  Fedify, a TypeScript library for building federated applications using ActivityPub, contains a vulnerability that allows attackers to manipulate cryptographically signed activities without invalidating the signatures. By exploiting JSON-LD (JSON Linked Data) restructuring techniques, an attacker who receives a validly signed activity from a third party can alter its meaning and content while the Linked Data Signature remains valid. This breaks the integrity guarantee that signatures are supposed to provide, enabling attackers to forge or modify federated messages in a way that appears authentic.

• CVE-2026-56329MEDIUM 6.4

  Capgo versions before 12.128.2 have a namespace collision vulnerability in how preview URLs are parsed. The system decodes double underscores to dots in a way that isn't unique—meaning an attacker can register an app ID with underscores that collides with another tenant's dotted app ID. This causes preview traffic to be misrouted and can deny legitimate users access to their preview environments.

• CVE-2026-53655MEDIUM 5.5

  Node-tar, a popular JavaScript tar archive library, contains a flaw in how it interprets PAX extended headers—a standard mechanism for adding metadata to tar entries. An attacker can craft a malicious tar file that causes node-tar to misalign its reading position within the archive. This misalignment makes node-tar extract a different set of files than other standard tar tools (GNU tar, libarchive, Python's tarfile module). The practical danger: if your organization uses one library to scan an archive for malware or secrets and a different library to actually extract it, an attacker can hide a malicious file from the scanner while ensuring it gets extracted anyway. This creates a gap in security tooling that could allow sensitive or harmful content to slip through undetected.

• CVE-2026-40930MEDIUM 5.4

  A parsing flaw in libpng 1.8.0's APNG (Animated PNG) handler can cause specially crafted image data to be misinterpreted. When the parser encounters certain frame chunks in an APNG file, it clears internal state flags but fails to skip over the actual chunk data and checksum. On the next data processing call, bytes from the ignored chunk can masquerade as a new chunk header, potentially leading to integrity violations or denial of service. An attacker needs user interaction—typically opening a malicious PNG file—to trigger the issue.

• CVE-2026-59882MEDIUM 4.2

  A flaw in guzzlehttp/psr7 (a widely-used PHP HTTP message library) allows attackers to craft URIs with specially-formatted host components that bypass validation. The library's host validation function fails to catch authority delimiters, embedded ports, or malformed IPv6 brackets, creating a disconnect between what the library reports as the host and what the URI actually specifies. This mismatch can confuse security checks or routing logic that rely on the reported host value.

• CVE-2026-53537LOW 3.7

  Python-Multipart before version 0.0.30 contains a header parsing vulnerability that could allow an attacker to bypass security controls. The library uses email message parsing for Content-Disposition and Content-Type headers, which automatically decodes RFC 2231/5987 extended parameter syntax (like filename*=). This decoding is not supposed to happen in multipart form data per the relevant RFC standard. An attacker can craft a specially formatted header that gets decoded differently by the vulnerable library than by upstream security tools (WAFs, proxies), potentially smuggling through a different field name or filename than inspectors expect. The risk is relatively low because successful exploitation requires specific conditions and produces only minor integrity issues, not data exposure or system unavailability.

• CVE-2026-53538LOW 3.7

  Python-Multipart versions before 0.0.30 contain a parser differential vulnerability in how they handle form-encoded data. The library treats semicolons (;) as field separators in form submissions, while modern standards—including web browsers and Python's built-in URL parser—only recognize ampersands (&) as separators. An attacker can exploit this mismatch to inject additional form fields that bypass security inspections performed by upstream components, such as web application firewalls or input validators. The attacker doesn't need special privileges or user interaction, though the attack requires specific conditions to trigger successfully.