Michelle Tilley TOML Parser for Node.js resource management error vulnerability

Michelle Tilley’s TOML Parser for Node.js versions prior to 5.0.1 contain a resource management error vulnerability. This vulnerability arises from repeatedly slicing and reassembling path prefixes when handling long point-based keys, header fields, array headers, and inline table keys. This...

CVE-2026-108062

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

EUVD-2026-104908

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

CVE-2026-108062

The CVE-2026-108062 vulnerability involves pre-authentication OIDC discovery and JWKS fetches running synchronously on the asyncio event loop . This synchronous execution causes a single unauthenticated request to stall the entire service, leading to a CWE-400 Uncontrolled Resource Consumption is...

CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

PT-2026-118501

Name of the Vulnerable Software and Affected Versions ApostropheCMS Form versions prior to 1.5.5 Description The form submission endpoint '/api/v1/@apostrophecms/form/submit' processes unbounded multipart uploads using the multer function before performing authentication, API-key verification, or...

PT-2026-118322

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

DEBIAN-CVE-2026-111766

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

CVE-2026-111766

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

CVE-2026-111766

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

CVE-2026-111766 markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

CVE-2026-111766

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

CVE-2026-111766 markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

CVE-2026-111766 markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...

CVE-2026-111766

The markdown-it Markdown parser is vulnerable to a quadratic-time denial of service (DoS) in versions prior to 14.3.3 and 15.0.3 . When the html option or commonmark preset is enabled, processing attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instru...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via analyzeRepeatedExtglob in lib/parse.js, which skips single-branch repeated extglob patterns such as + or +a. An attacker can supply these glob patterns to trigger exponential backtracking i...

DoS (Denial of Service) axios Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.1 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

AZL-109833 CVE-2026-112366 affecting package nodejs-nodemon 2.0.3-5

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like + or +a, which analyzeRepeatedExtglob in lib/parse.js skips, causing exponenti...