{"vulnerability": "cve-2026-7185", "sightings": [{"uuid": "c72e6808-916c-46fe-a19e-65e39516bf29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msjb5v4unw26", "content": "CVE-2026-71851 - crypto-js\nAn outdated version of CryptoJS used in wallet applications can generate weak random numbers for BIP39 recovery phrases, potentially allowing attackers to guess them. This issue\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cryptojs #npm #CVE #infosec", "creation_timestamp": "2026-08-07T19:12:05.646091Z"}, {"uuid": "80eb0903-a11d-40ab-ab3b-11ff7bc67654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71852", "type": "seen", "source": "https://gist.github.com/alon710/81b96826f50cad7313904ff9c7c75f2e", "content": "# CVE-2026-71852: CVE-2026-71852: Denial of Service via Excessive Iteration and Memory Exhaustion in pypdf CID Font Parsing\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71852\n\n## Summary\nA Denial of Service (DoS) vulnerability exists in pypdf prior to version 6.15.0. When parsing maliciously crafted PDF files containing excessively large CID font width ranges, the library suffers from CPU starvation and memory exhaustion due to unconstrained loop expansion.\n\n## TL;DR\nUnconstrained CID font width expansion in pypdf leads to application hang and OOM crashes.\n\n## Technical Details\n\n- **CWE ID**: CWE-834\n- **Attack Vector**: Local\n- **CVSS v4.0**: 4.8\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Any Python application or backend service utilizing pypdf versions prior to 6.15.0 to extract text, parse metadata, or merge PDF documents.\n- **pypdf**: < 6.15.0 (Fixed in: `6.15.0`)\n\n## Mitigation\n\n- Upgrade pypdf to 6.15.0 or later.\n- Implement process memory constraints via Docker or cgroups.\n- Apply input-size limits on uploaded PDF files.\n\n**Remediation Steps:**\n1. Identify all environments using pypdf.\n2. Execute 'pip install --upgrade pypdf>=6.15.0'.\n3. Verify that parsing tasks do not fail on legitimate PDFs.\n4. Apply application-level timeouts and sandbox boundaries for document processing workers.\n\n## References\n\n- [https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42](https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42)\n- [https://github.com/py-pdf/pypdf/pull/3946](https://github.com/py-pdf/pypdf/pull/3946)\n- [https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7](https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7)\n- [https://github.com/py-pdf/pypdf/releases/tag/6.15.0](https://github.com/py-pdf/pypdf/releases/tag/6.15.0)\n- [https://www.cve.org/CVERecord?id=CVE-2026-71852](https://www.cve.org/CVERecord?id=CVE-2026-71852)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71852) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T19:36:23.846466Z"}, {"uuid": "124f6059-724b-4421-8b22-bd9d807ba0b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hmgetop3cozq3", "content": "CVE-2026-71851 - crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain\nCVE ID : CVE-2026-71851\n \n Published : Aug. 7, 2026, 7:18 p.m. | 36\u00a0minutes ago\n \n Description : crypto-js is a JavaScript library of crypto standards. ...", "creation_timestamp": "2026-08-07T20:04:08.022943Z"}, {"uuid": "2ef31926-0304-4727-be9a-cb04eb3cc024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71851", "type": "published-proof-of-concept", "source": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9", "content": "", "creation_timestamp": "2026-08-07T20:35:06.834983Z"}, {"uuid": "55d775ed-892a-4dc9-b302-903a890ab84f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://gist.github.com/alon710/fa679955da8f3503916dff57f8688b8c", "content": "# CVE-2026-71851: CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom)\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71851\n\n## Summary\nA severe, twelve-year-old cryptographic weakness in crypto-js (versions < 4.0.0) generated pseudorandom numbers using a custom Multiply-With-Carry (MWC) algorithm seeded from the non-secure Math.random(). This reduces 128-bit and 256-bit key spaces to just 2^39 and 2^47 possibilities, allowing offline brute-force attacks.\n\n## TL;DR\nLegacy versions of crypto-js generate weak keys using Math.random() in a custom MWC generator, enabling attackers to systematically brute-force and drain cryptocurrency wallets.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-338\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.0 (Critical)\n- **Exploit Status**: Active In-The-Wild\n- **Primary Impact**: Private Key Compromise and Asset Theft\n- **Component**: CryptoJS.lib.WordArray.random()\n\n## Affected Systems\n\n- crypto-js <= 3.3.0\n- Legacy web3 wallets\n- Decentralized browser extensions using crypto-js 3.x\n- Hybrid mobile applications bundling legacy crypto-js dependencies\n- **crypto-js**: >= 3.1.2-4, < 4.0.0 (Fixed in: `4.0.0`)\n\n## Mitigation\n\n- Upgrade crypto-js dependency to version 4.0.0 or higher.\n- Implement platform-native secure random generation APIs.\n- Rotate all cryptographic keys and seed phrases generated under vulnerable versions.\n\n**Remediation Steps:**\n1. Verify installed dependencies using npm ls crypto-js.\n2. Upgrade packages to version 4.0.0 or later.\n3. Generate new mnemonic phrases and migrate wallet assets to fresh addresses.\n\n## References\n\n- [Ill Bloom Dedicated Research & Address Checker](https://illbloom.org/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71851) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T21:31:50.457897Z"}, {"uuid": "1b5fbd6d-e8d4-4320-bdd6-faa648212ab8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71850", "type": "seen", "source": "https://gist.github.com/alon710/6634ad7314d99c5586618c1848016378", "content": "# CVE-2026-71850: CVE-2026-71850: Server-Side Rendering Data Exposure in Hono JSX Memoization\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71850\n\n## Summary\nA session data exposure vulnerability in the Hono web application framework (hono/jsx module) allows consecutive users to receive cached HTML outputs containing private data. When JSX components wrapped in `memo()` are rendered on the server, the caching mechanism utilizes a module-level closure that persists across independent HTTP requests. When subsequent requests occur with matching props, the components are not re-evaluated, and cached HTML is served. If these components read request-scoped or session-specific data via ambient APIs, the data of the first user is exposed to subsequent users.\n\n## TL;DR\nA session isolation flaw in Hono's JSX SSR engine caches rendered HTML globally when using the `memo()` utility. This causes the framework to serve cached data (including CSRF tokens and user profile details) belonging to previous users to subsequent visitors when components are rendered with identical props.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-488 (Exposure of Data Element to Wrong Session)\n- **Attack Vector**: Network\n- **CVSS Score**: 4.8 (Medium)\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept\n- **Affected Versions**: >= 3.8.0, < 4.12.34\n- **Impact**: Information Disclosure (Request-scoped data, CSRF tokens)\n\n## Affected Systems\n\n- Hono applications using server-side rendering (SSR) with hono/jsx\n\n## Mitigation\n\n- Upgrade the hono package to version 4.12.34 or higher.\n- Remove the memo() wrapper from server-side rendered components.\n- Refactor components to accept all dynamic, request-scoped parameters as props rather than reading ambient context values.\n\n**Remediation Steps:**\n1. Verify current Hono framework version using npm list hono or yarn licenses list.\n2. Update Hono to version 4.12.34 or higher: npm install hono@4.12.34.\n3. Audit codebase for the import and usage of memo from 'hono/jsx' or 'hono/jsx/dom'.\n4. Remove memo() wrappers around server-side components that retrieve request-specific information.\n5. Deploy the patched application to production and monitor server access logs.\n\n## References\n\n- [Hono Security Advisory GHSA-f23p-vx2j-j53r](https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r)\n- [Official Fix Commit](https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f)\n- [Hono v4.12.34 Release Notes](https://github.com/honojs/hono/releases/tag/v4.12.34)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71850) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T22:31:14.254519Z"}, {"uuid": "b552db37-6ae2-4d58-b298-d719f8b5a2da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71850", "type": "seen", "source": "https://gist.github.com/alon710/6634ad7314d99c5586618c1848016378", "content": "# CVE-2026-71850: CVE-2026-71850: Server-Side Rendering Data Exposure in Hono JSX Memoization\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71850\n\n## Summary\nA session data exposure vulnerability in the Hono web application framework (hono/jsx module) allows consecutive users to receive cached HTML outputs containing private data. When JSX components wrapped in `memo()` are rendered on the server, the caching mechanism utilizes a module-level closure that persists across independent HTTP requests. When subsequent requests occur with matching props, the components are not re-evaluated, and cached HTML is served. If these components read request-scoped or session-specific data via ambient APIs, the data of the first user is exposed to subsequent users.\n\n## TL;DR\nA session isolation flaw in Hono's JSX SSR engine caches rendered HTML globally when using the `memo()` utility. This causes the framework to serve cached data (including CSRF tokens and user profile details) belonging to previous users to subsequent visitors when components are rendered with identical props.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-488 (Exposure of Data Element to Wrong Session)\n- **Attack Vector**: Network\n- **CVSS Score**: 4.8 (Medium)\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept\n- **Affected Versions**: >= 3.8.0, < 4.12.34\n- **Impact**: Information Disclosure (Request-scoped data, CSRF tokens)\n\n## Affected Systems\n\n- Hono applications using server-side rendering (SSR) with hono/jsx\n\n## Mitigation\n\n- Upgrade the hono package to version 4.12.34 or higher.\n- Remove the memo() wrapper from server-side rendered components.\n- Refactor components to accept all dynamic, request-scoped parameters as props rather than reading ambient context values.\n\n**Remediation Steps:**\n1. Verify current Hono framework version using npm list hono or yarn licenses list.\n2. Update Hono to version 4.12.34 or higher: npm install hono@4.12.34.\n3. Audit codebase for the import and usage of memo from 'hono/jsx' or 'hono/jsx/dom'.\n4. Remove memo() wrappers around server-side components that retrieve request-specific information.\n5. Deploy the patched application to production and monitor server access logs.\n\n## References\n\n- [Hono Security Advisory GHSA-f23p-vx2j-j53r](https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r)\n- [Official Fix Commit](https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f)\n- [Hono v4.12.34 Release Notes](https://github.com/honojs/hono/releases/tag/v4.12.34)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71850) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T00:01:19.529811Z"}, {"uuid": "6be479dc-b607-4296-a99e-f3b806cfd0e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msk3dxl5gn23", "content": "\ud83d\udd34 CVE-2026-71851 - Critical (9)\n\ncrypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 gener...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71851/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-08T03:00:47.380865Z"}, {"uuid": "5471ff3e-3c46-42ac-987d-4672371bf477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71851", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117058006236524756", "content": "CVE-2026-71851 (CRITICAL, CVSS 9): brix crypto-js <4.0.0 uses weak RNG in WordArray.random(), risking private key recovery in wallet apps using BIP39. Upgrade to 4.0.0+ now. https://radar.offseq.com/threat/cve-2026-71851-cwe-331-insufficient-entropy-in-brix-crypto-js-e5283f6c465bd95e #OffSeq #CryptoJS #InfoSec #Vulnerability", "creation_timestamp": "2026-08-08T04:30:25.909750Z"}, {"uuid": "ec632e76-0c19-4daf-bc5e-af461b4901c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71851", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mskaecwoh72v", "content": "brix crypto-js CRITICAL flaw (CVE-2026-71851): Insufficient entropy in WordArray.random() exposes wallets to private key theft. Affected: 3.1.2-4 to <4.0.0. Upgrade to 4.0.0+ ASAP. https://radar.offseq.com/threat/cve-2026-71851-cwe-331-insufficient-entropy-in-brix-crypto-js-e5283f6c465bd95e #OffS...", "creation_timestamp": "2026-08-08T04:30:27.672500Z"}, {"uuid": "952c988d-7e7d-44bb-b25d-0eb703b6e888", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7185", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpyixcoksd27", "content": "CVE-2026-7185 - Unauthorized access to files in T-Systems products\nCVE ID : CVE-2026-7185\n \n Published : July 6, 2026, 3:16 p.m. | 31\u00a0minutes ago\n \n Description : A validation vulnerability has been identified in certain web features related to file management or upload in sev...", "creation_timestamp": "2026-07-06T16:25:56.081896Z"}, {"uuid": "824443d9-b035-49ea-8a17-e320170f6bd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "Telegram/U-Lw1mLsBIRfCm1Ollw0n6rUh-gbSxMVEkANJuForVtnctY", "content": "", "creation_timestamp": "2026-09-02T01:00:08.844946Z"}, {"uuid": "bea826a8-80d0-4772-a84b-816038b8dedd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "published-proof-of-concept", "source": "Telegram/U-Lw1mLsBIRfCm1Ollw0n6rUh-gbSxMVEkANJuForVtnctY", "content": "", "creation_timestamp": "2026-09-03T00:00:56.590868Z"}]}