54924 matches found
10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3384 more potentially affected by CVE-2026-44294 via protobufjs (>=7.0.0, <=7.5.5)
protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-44294 Source advisory: OSV:GHSA-2PR8-PHX7-X9H3...
@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1052 more potentially affected by CVE-2026-44292 via protobufjs (>=8.0.0, <=8.0.1)
protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-44292 Source advisory: SNYK:JS-PROTOBUFJS-16643319...
@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1052 more potentially affected by CVE-2026-44290 via protobufjs (>=8.0.0, <=8.0.1)
protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-44290 Source advisory: SNYK:JS-PROTOBUFJS-16643419...
10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3384 more potentially affected by CVE-2026-44290 via protobufjs (>=7.0.0, <=7.5.5)
protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-44290 Source advisory: OSV:GHSA-JVWF-75H9-CWGG...
10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3384 more potentially affected by CVE-2026-44290 via protobufjs (>=7.0.0, <=7.5.5)
protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-44290 Source advisory: SNYK:JS-PROTOBUFJS-16643419...
AZL-86805 CVE-2026-40016 affecting package dovecot 2.3.20-1
Attacker can upload a malicious Sieve script over ManageSieve service or locally to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed...
BIT-ARGO-WORKFLOWS-2026-42294 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...
Fortinet FortiManager DoS due to unsafe function in signal handler (FG-IR-26-137)
The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-137 advisory. - A use of potentially Dangerous Function vulnerability CWE-676 in FortiAnalyzer and FortiManager API may allow an...
Important: Red Hat Security Advisory: host-metering security update
An update for host-metering is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
GHSA-9F4Q-Q82Q-4359 Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks
Docling's METS GBS backend is vulnerable to XML Entity Expansion XXE attacks thru 2.61.0. The backend extracts and validates XML files from .tar.gz archives using etree.fromstring without disabling entity resolution. An attacker can craft a malicious XML file with nested entity definitions XML Bo...
EUVD-2026-29095
Docling's METS GBS backend is vulnerable to XML Entity Expansion XXE attacks thru 2.61.0. The backend extracts and validates XML files from .tar.gz archives using etree.fromstring without disabling entity resolution. An attacker can craft a malicious XML file with nested entity definitions XML Bo...
AZL-86772 CVE-2026-4890 affecting package dnsmasq for versions less than 2.92-1
A Denial of Service DoS vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet...
AZL-86381 CVE-2026-40612 affecting package jq for versions less than 1.7.1-6
jq is a command-line JSON processor. In 1.8.1 and earlier, jvcontains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure built programmatically with reduce, since the JSON parser caps at depth 10000, the C stack is exhausted...
Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Input Validation vulnerability (CVE-2025-15284, CVE-2026-2391)
Summary There are vulnerabilities in qs-6.14.0.tgz, qs-6.14.1.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-15284, CVE-2026-2391. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation vulnerability in qs...
CVE-2026-7790 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS
Uncontrolled Resource Consumption vulnerability in ninenines cowlib cowhttpte module allows Excessive Allocation. The chunked transfer-encoding parser in cowhttpte accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication Len 16 + digit, so parsi...
-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 03-gs-ee-6 (0.3.5) +40682 more potentially affected by CVE-2026-44576 via next (>=14.2.0, <=15.5.15)
next NPM version =14.2.0, =0.1.0, =1.0.0, =0.1.0, =1.1.4 - 21guns 1.1.2 - 2bv2 1.4.8 and more Source cves: CVE-2026-44576 Source advisory: SNYK:JS-NEXT-16638676...
-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +848 more potentially affected by CVE-2026-44575 +1 more via next (>=15.2.0, <=15.5.15)
next NPM version =15.2.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2026-44575, CVE-2026-45109 Source advisory: SNYK:JS-NEXT-16638685...
CVE-2026-8289 Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service
A vulnerability was identified in Open5GS up to 2.7.7. This vulnerability affects the function smfnsmfhandleupdatedatainvsmf of the file /src/smf/nsmf-handler.c of the component SMF. The manipulation of the argument qosFlowProfile leads to denial of service. Remote exploitation of the attack is...
CVE-2026-8288
A vulnerability was determined in Open5GS up to 2.7.7. This affects the function gsmhandlepdusessionmodificationqosflowdescriptions of the file src/smf/gsm-handler.c of the component SMF. Executing a manipulation of the argument n1SmMsg can lead to denial of service. The attack may be launched...