GHSA-8MPW-7FPC-4GQJ NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

Summary Pl196xCorpusReader still parses whole TEI blocks with multiple lazy regexes over attacker-controlled text. A malformed file with many opening tags and no matching closing tags forces repeated rescans and produces quadratic CPU growth in public reader APIs. Details - Vulnerability type:...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

DEBIAN-CVE-2026-86430

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

CVE-2026-4945

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

EUVD-2026-72388

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

EUVD-2026-72366

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

CVE-2026-4945 Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

CVE-2026-4945

The Otter Blocks plugin for WordPress (Gutenberg Blocks, Page Builder & FSE) is vulnerable to Insecure Direct Object Reference (IDOR) in the watch_checkout function across all versions up to and including 3.1.7 . The root cause is missing validation on a user-controlled key, allowing unauthentica...

CVE-2026-4945 Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

WordPress Otter Blocks plugin <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass vulnerability

Missing Authorization to Unauthenticated Purchase Verification Bypass vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Otter - Gutenberg Block versions = 3.1.7...

CVE-2026-4945: Authorization Bypass Through User-Controlled Key

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

PT-2026-86796

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

PT-2026-86752

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch checkout' function due to missing validation on a user controlled key. This makes it...

CVE-2026-19858: Exposure of Sensitive Information to an Unauthorized Actor

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...

CVE-2026-19861: Improper Neutralization of Input During Web Page Generation

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrato...

CVE-2026-86115: Unintended Proxy or Intermediary

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...

CVE-2024-11080: Improper Control of Generation of Code

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

GHSA-H6W7-XXCF-W2MQ SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72795. Summary /api/block/getBlockDOMWithEmbed and /api/block/getBlockDOMsWithEmbed gate only the requested block against publish access. The blocks pulled in by that block's embed transclusion query are inlined into the returned DOM with no...

CVE-2026-74994

A flaw was found in the modauth module of OTP's inets httpd server. When configured with multiple directory configuration blocks and using dets or mnesia authentication backends, the module incorrectly collapses all directory blocks into a single shared user/group namespace. This allows a user...

SUSE CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...