🔗
fast-uri URL Parsing Flaw Can Bypass Host-Based Security Checks
Teams using fast-uri for URL validation or SSRF defenses should patch promptly. There is no workaround, so upgrading is the recommended action.
CVE-2026-16221 is a HIGH severity vulnerability with CVSS 7.5 affecting fast-uri versions 2.3.1 through 4.1.0. The library parses backslashes differently from Node’s native WHATWG URL parser, allowing mismatched host resolution. Applications that rely on fast-uri for allowlists, SSRF filtering, redirect validation, or proxy routing before passing URLs to Node components may be redirected to unintended internal or cloud metadata endpoints. Fixed versions are 4.1.1, 3.1.4, and 2.4.3.
🔗 Read more 🔗
Source: NVD
💉
SQL Injection Found in SourceCodester Class and Exam Timetabling System
Anyone running the affected application should treat this as a high-priority fix because a public exploit exists. Restrict access and apply vendor updates or code fixes as soon as possible.
CVE-2026-16228 is a HIGH severity vulnerability with CVSS 7.3 affecting SourceCodester Class and Exam Timetabling System 1.0. An unknown function in /edit_schoolyr.php is vulnerable to SQL injection through manipulation of the ID parameter. The attack can be launched remotely, and a public exploit is available.
🔗 Read more 🔗
Source: NVD
🛡️
Public SQL Injection Vulnerability Impacts SourceCodester Timetabling System
Organizations using this software should patch quickly or limit external exposure. Public exploit availability increases the likelihood of opportunistic attacks.
CVE-2026-16227 is a HIGH severity vulnerability with CVSS 7.3 affecting SourceCodester Class and Exam Timetabling System 1.0. An unknown function in /edit_subject.php allows SQL injection through the ID parameter. The vulnerability is remotely exploitable, and the exploit has been publicly disclosed.
🔗 Read more 🔗
Source: NVD
🐍
uproot Code Generation Bug Enables Arbitrary Python Execution
Developers and researchers handling untrusted ROOT files should update immediately. Avoid opening files from untrusted sources until patched.
CVE-2026-9147 is a HIGH severity vulnerability with CVSS 7.8 affecting uproot. The library generates Python source code from ROOT file metadata and fails to safely quote certain file-controlled fields, allowing crafted files to inject and execute arbitrary Python code. Applications processing untrusted ROOT files are at risk.
🔗 Read more 🔗
Source: NVD
⚡
Fastify Reply Plugin Cache Collision Risks Cross-Upstream Access
Fastify deployments using @fastify/reply-from should patch as a priority. If an upgrade is not immediately possible, enable disableCache as a temporary mitigation.
CVE-2026-16158 is a HIGH severity vulnerability with CVSS 8.7 affecting @fastify/reply-from versions 8.3.1 up to but not including 12.6.4. An improperly constructed internal URL cache key can cause requests intended for one upstream to reuse cached data for another, leading to cross-upstream data access or modification. The issue is fixed in version 12.6.4, and disabling the cache mitigates the problem.
🔗 Read more 🔗
Source: NVD
🌐
Fastify HTTP Proxy WebSocket Traversal Flaw Exposes Hidden Endpoints
Operators using @fastify/http-proxy with WebSocket support should prioritize upgrading. Although exploitation requires specific client behavior, exposed proxy deployments should not delay patching.
CVE-2026-15631 is a HIGH severity vulnerability with CVSS 8.7 affecting @fastify/http-proxy versions 9.4.0 through 11.5.0. Improper validation of resolved WebSocket destination paths allows crafted requests with path traversal sequences to escape the configured rewrite prefix and reach unintended upstream endpoints. The issue is fixed in version 11.6.0 and has no workaround.
🔗 Read more 🔗
Source: NVD