CLEANSTART-2026-LJ21739 client may issue specially crafted HTTP/1

Security vulnerability affects the kafka package. A client may issue specially crafted HTTP/1...

CVE-2026-81856

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the documentati...

CVE-2026-95155

The FasterXML Jackson 1.x library is vulnerable to a Denial of Service (DoS) attack, specifically confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13 . The root cause is uncontrolled recursion (CWE-674), where an attacker can supply deeply nested JSON input to an app...

UBUNTU-CVE-2026-81856

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the documentati...

UBUNTU-CVE-2026-96612

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...

UBUNTU-CVE-2026-105274

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

EUVD-2026-102127

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-96612

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...

UBUNTU-CVE-2026-103503

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacertspath to a CA store that leaves that CA out...

CVE-2026-105274

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

HTTP Request Smuggling

Overview io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to HTTP Request Smuggling due to inconsistent interpretation of headers in the isContentLength and isContentType helpers of the VertxHttpRequestDecoder class,...

CVE-2026-110310

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...

CVE-2026-110310 RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...

CVE-2026-102479

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

CVE-2026-102479

The io.vertx:vertx-core component in Eclipse Vert.x versions [5.0.0, 5.0.12] , [5.1.0, 5.1.9] , or [5.2.0, 5.2.0] contains a vulnerability in the HTTP/1.x decoder . The root cause is an improper canonicalization process for well-known HTTP headers, which allows crafted headers (e.g., Content-Xeng...

CVE-2026-102479

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

CVE-2026-102479

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

CVE-2026-106464

nxsecurex509parsesignaturedata computes the certificate signature's length as tlvlength - 1 without first checking that tlvlength is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of 0xFFFFFF...

CVE-2026-92097

The Click to Chat for WhatsApp plugin for WordPress (versions up to and including 4.44 ) is vulnerable to Unauthenticated Arbitrary Shortcode Execution . The issue originates in the greetings_dialog() function, which constructs the {url} template placeholder using a sanitize_text_field()-filtered...