PT-2026-86794

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming...

Linux Distros Unpatched Vulnerability : CVE-2026-86434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its...

CVE-2026-86231

A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument knownhosts results in improper check for certificate revocation. The attack is possible to ...

CVE-2026-86227

A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high...

CVE-2026-86227 valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds

A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high...

CVE-2026-86250

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On² cleanup loop that hangs the server...

CVE-2020-37277

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

CVE-2020-37277

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

CVE-2026-86250

h3 versions before 2.0.1-rc.18 contain a denial-of-service vulnerability in the setChunkedCookie() and deleteChunkedCookie() functions. The library fails to validate the chunk count parsed from user-controlled cookie values, allowing a remote, unauthenticated attacker to send a crafted cookie hea...

CVE-2020-37277

PocketMine-MP versions prior to 3.15.4 are affected by a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. A malicious, authenticated client can send specially crafted InventoryTransactionPackets containing multiple conflicting pathways , causing exp...

EUVD-2020-31270

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

CVE-2020-37277 PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

CVE-2020-37277 PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

PT-2026-86513

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

OESA-2026-3690 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTT...

OESA-2026-3669 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts...

MGASA-2026-0377 Updated python-linkify-it-py package fixes security vulnerabilities

LinkifyIt.match was quadratic on untrusted input when linkify is enabled GHSA-8m2q-wq3r-6hq8. Fix quadratic complexity in LinkifyIt.match, port of linkify-it 5.0.1 and 5.0.2 upstream CVE-2026-48801, CVE-2026-59887 82 Match validators at a position instead of slicing the tail, needed because Pytho...

Updated python-linkify-it-py package fixes security vulnerabilities

LinkifyIt.match was quadratic on untrusted input when linkify is enabled GHSA-8m2q-wq3r-6hq8. Fix quadratic complexity in LinkifyIt.match, port of linkify-it 5.0.1 and 5.0.2 upstream CVE-2026-48801, CVE-2026-59887 82 Match validators at a position instead of slicing the tail, needed because Pytho...

Updated mingw-expat & expat packages fix security vulnerabilities

Expat Denial of Service via storeAtts Quadratic Complexity. CVE-2026-66046 Expat Out-of-Bounds Read via dtdCopy. CVE-2026-76641 In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding...

MGASA-2026-0378 Updated mingw-expat & expat packages fix security vulnerabilities

Expat Denial of Service via storeAtts Quadratic Complexity. CVE-2026-66046 Expat Out-of-Bounds Read via dtdCopy. CVE-2026-76641 In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding...