CVE-2026-82398

pypdf , a pure-Python PDF library, is vulnerable to excessive resource consumption in the read_until_whitespace function within pypdf/_utils.py. When processing a crafted PDF containing a long sequence of non-whitespace bytes, the function performs immutable bytes concatenation in a one-byte loop...

PT-2026-84050

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.15.0 Description A flaw exists where an attacker can craft a PDF file that triggers long runtimes. This occurs when the read until whitespace function in pypdf/ utils.py processes a stream containing a long sequence o...

CVE-2026-81931

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

EUVD-2026-67225

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

CVE-2026-81931

Roskus Prospero Flow CRM before 5.16.0 is affected by an unrestricted file upload in the product photo feature. The validation logic checks only magic bytes and blocks a fixed list of PHP extensions , but ProductSaveController::save() stores the file using the client-supplied extension in the pub...

CVE-2026-81931 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

CVE-2026-81931 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

CVE-2026-81694

openssl-encrypt (pip package, versions ≤ 1.4.8) is vulnerable to output injection in the verify-usb command. Filenames read from untrusted drive data—residing outside the AES-GCM authenticated manifest —are printed without sanitization, allowing an attacker to plant terminal cursor-movement and e...

CVE-2026-81694 verify-usb before 1.4.9 Output Injection via Unsanitized Filenames

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-79771

A flaw was found in Nokogiri. Attackers can exploit a memory leak in the XSLT Stylesheet transform method by providing specially crafted input containing null bytes. This can lead to excessive memory consumption and enable a denial of service against long-running processes...

Linux Distros Unpatched Vulnerability : CVE-2026-79771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can...

CVE-2026-80101 Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation...

GHSA-RH9X-7XJC-VWX2 Duplicate Advisory: Nokogiri XSLT transform has a memory leak

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v2fc-qm4h-8hqv. This link is maintained to preserve external references. Original Description Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby...

CVE-2026-79771

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...

CVE-2026-79771

Nokogiri versions before 1.19.3 are affected by a memory leak in the XSLT Stylesheet transform method. The root cause is heap allocations leaking when Ruby strings containing null bytes are passed as transform parameters. An unauthenticated, network-based attacker can trigger this by supplying cr...

CVE-2026-79771 Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...

EUVD-2026-65529

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...

CVE-2026-79771

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...

CVE-2026-79771 Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...

Linux Distros Unpatched Vulnerability : CVE-2026-76816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client...