Zod Can Exhaust Memory While Validating Oversized Constrained Collections

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic ...

Exploit for CVE-2026-114509

CVE-2026-114509 — Laravel TokenGuard authentication bypass PoC...

Medium: alsa-lib

Issue Overview: alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state fil...

Linux Distros Unpatched Vulnerability : CVE-2026-115722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value typ...

Improper Validation of Array Index

Overview rply is a Python parser generator, that also works with RPython. Affected versions of this package are vulnerable to Improper Validation of Array Index via improper array index validation in plyreadheaderproperty, which accepts list as a list property's length or value type. An attacker...

CVE-2026-99006

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...

DEBIAN-CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

EUVD-2026-108710

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects

A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...

follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects

A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...

follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects

A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...

PT-2026-121834

RPly through 1.1.4 contains an improper array index validation vulnerability in ply read header property that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply read list property call an out-of-bounds handler, crashing ASCII parsing or...

PT-2026-121899

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 nested virtualization implementation regarding the life cycle of the nested mmus array, which stores shadow page tables used during nested contexts. When...

CVE-2026-114648 NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys

The MongoDB C Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or...

GHSA-4QX8-W7C3-PJ3P toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via many array-of-tables name headers. addTableArray in lib/compiler.js rescans two entire bookkeeping Sets on every name header without pruning unrelated or distinct entries, so a document containing n such headers...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the compiler in lib/compiler.js, where processing an array-of-tables header causes a full rescan of every path defined so far. An attacker can supply a TOML document with a large number of...

npm: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

npm: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

Summary toml.parse is vulnerable to a quadratic-complexity On² denial-of-service via many array-of-tables name headers. addTableArray in lib/compiler.js rescans two entire bookkeeping Sets on every name header without pruning unrelated or distinct entries, so a document containing n such headers...