AZL-110241 CVE-2026-87863 affecting package rust 1.96.1-2

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

AZL-110307 CVE-2026-87863 affecting package tensorflow 2.16.1-11

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

AZL-110142 CVE-2026-87863 affecting package rust 1.75.0-31

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

Use of GET Request Method With Sensitive Query Strings

Overview @apostrophecms/passport-bridge is a Passport.js authentication for Apostrophe Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings via an unspecified vector in the package, allowing an authenticated attacker with low privileges to rea...

Use of GET Request Method With Sensitive Query Strings

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Allocation of Resources Without Limits or Throttling

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling which allows an unauthenticated remote attacker to create server-side upload state, write chunk data to...

3lc (>=2.3.84, <=2.11.2), a-data-processing (0.0.1) +295 more potentially affected by CVE-2026-112397 via pillow (10.2.0)

pillow PYPI version 10.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3lc =2.3.84, =0.2.3, =1.6.0, =0.21.0, =0.0.2, =0.0.1, =0.0.1, =24.2.0, =0.0.7, =1.0.3.dev0, =1.1.0 and more Source cves: CVE-2026-112397 Source...

EUVD-2026-104606

Pillow tiled-TIFF decoder reads past tile buffer in copy4 Unpack.c:1290...

CVE-2026-113602

A flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute 0x1A character followed by malformed content. This causes strict-mode validation checks to prematurely finish parsing and accept...

CVE-2026-92389

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

EUVD-2026-105319

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389

The libcurl library's TFTP state machine fails to validate state transitions against the requested transfer direction, allowing it to accept opening server responses for both reads and writes interchangeably. A malicious TFTP server can exploit this by responding to a download request in a way th...

CVE-2026-92389 TFTP direction confusion

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

DEBIAN-CVE-2026-113720

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

AZL-110118 CVE-2026-113720 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

CVE-2026-113720

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

AZL-110121 CVE-2026-113719 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...