CVE-2026-119187

The Forge (also known as node-forge ) JavaScript TLS implementation is vulnerable to a Denial of Service (DoS) via call stack exhaustion. In versions prior to 1.4.1 , the forge.tls.createConnection() function processes received TLS records recursively, consuming one JavaScript stack frame per rec...

CVE-2026-119187 Forge: Denial of service in TLS record processing via call stack exhaustion

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

CVE-2026-119187 Forge: Denial of service in TLS record processing via call stack exhaustion

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

CVE-2026-119187

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

CVE-2026-119187: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

PT-2026-132807

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1 Description Forge, a native JavaScript implementation of Transport Layer Security, handles received TLS records recursively when using the forge.tls.createConnection function and the process function for TLS recor...

Linux Distros Unpatched Vulnerability : CVE-2026-99018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp...

DEBIAN-CVE-2026-99018

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

CVE-2026-99018

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

CVE-2026-99018

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

UBUNTU-CVE-2026-99018

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

CVE-2026-99018 riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

CVE-2026-99018

The Linux kernel contains a vulnerability under CONFIG_SHADOW_CALL_STACK where the handle_exception() function incorrectly uses the user-writable tp register to determine if a trap originated from userspace. An unprivileged user can manipulate tp to bypass the shadow call stack reload, causing th...

CVE-2026-99018 riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

CVE-2026-99018

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

EUVD-2026-108812

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

PT-2026-121995

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIG SHADOW CALL STACK, handle exception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision wit...

ApostropheCMS Sanitize-html: Unbounded Recursion When Re-sanitizing The Fallback Of A Discarded Iframe (stack Overflow,

Summary Since 2.18.0, when an "" is not allowed and "disallowedTagsMode" is "'discard'" the defaults, its raw-text content is re-sanitized by a recursive call to "sanitizeHtmltext, options" the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh stat...

CVE-2020-37287

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the...

CVE-2020-37287

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the...