UBUNTU-CVE-2026-59168

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-91863

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

PT-2026-96165

Name of the Vulnerable Software and Affected Versions Dasel versions 3.0.0 through 3.11.0 Description Dasel is a command-line tool and library for querying, modifying, and transforming data structures. The software fails to implement a depth guard when recursing per input nesting level within the...

Linux Distros Unpatched Vulnerability : CVE-2026-63638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, a...

UBUNTU-CVE-2026-57226

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in...

CVE-2026-57226

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in...

CVE-2026-57226

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in...

CVE-2026-57226 Suricata swf: heap buffer overflow in SWF decompression depth handling

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in...

CVE-2026-63638

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

CVE-2026-63638

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

CVE-2026-68914

CVE-2026-68914 is a duplicate of CVE-2026-14803 . The underlying vulnerability affects the Mojolicious Perl web framework, specifically the pure-Perl implementation of Mojo::JSON prior to version 9.47 . When Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled, the decoder does not limit...

EUVD-2026-83132

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

CVE-2026-63638

OpenImageIO (a VFX/animation image I/O toolset) is vulnerable to a heap out-of-bounds write in its Cineon image reader. A crafted cineon file can declare an unsupported component bit depth of 26 ; cineoninput::open() maps it to a 32-bit ImageSpec, but libcineon maps the depth to an 8-byte value, ...

CVE-2026-63638 OpenImageIO: Cineon invalid bit depth heap out-of-bounds write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

CVE-2026-63638 OpenImageIO: Cineon invalid bit depth heap out-of-bounds write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

CVE-2026-63638

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

CVE-2026-63638 OpenImageIO: Cineon invalid bit depth heap out-of-bounds write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

CVE-2026-63638

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

UBUNTU-CVE-2026-54627

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psdprivatesailpixelformat in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAILPIXELFORMATBPP1INDEXED without requiring...