13400 matches found
Red Hat: CVE-2026-112901: pillow: Pillow: Denial of Service via crafted XBM image header
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...
AXA NLP.js input validation error vulnerability
AXA NLP.js version 4.27.0 has a security vulnerability. This vulnerability stems from an incorrect handling of the condition parameter in the Evaluator.walkFunction function within the Condition Expression Pipeline component located at packages/evaluator/src/evaluator.js. This could lead to code...
WSO2 Enterprise Integrator code injection vulnerability
The WSO2 Enterprise Integrator version 6.6.0 up to 6.6.0.205 contained a code injection vulnerability. This vulnerability stemmed from insufficient data validation for user-provided data, allowing malicious Expression Language EL code to be injected. Attackers with administrative privileges could...
CVE-2026-78497
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...
CVE-2026-78497
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a "qr'...'" literal and compiled as source text, so a "? ... " code block in i...
EUVD-2026-103450
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...
CLSA-2026-1792309337 TuxCare security update for @babel/helper-explode-assignable-expression (2 CVEs)
TuxCare rebuilt @babel/helper-explode-assignable-expression to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...
CLSA-2026-1792309332 TuxCare security update for @babel/helper-explode-assignable-expression (1 CVE)
TuxCare rebuilt @babel/helper-explode-assignable-expression to address 1 CVE. Fixed in 7.12.18-tuxcare.2...
CLSA-2026-1792309334 TuxCare security update for @babel/helper-explode-assignable-expression (1 CVE)
TuxCare rebuilt @babel/helper-explode-assignable-expression to address 1 CVE. Fixed in 7.21.0-tuxcare.4...
CLSA-2026-1792309335 TuxCare security update for @babel/helper-explode-assignable-expression (1 CVE)
TuxCare rebuilt @babel/helper-explode-assignable-expression to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
CLSA-2026-1792309333 TuxCare security update for @babel/helper-explode-assignable-expression (1 CVE)
TuxCare rebuilt @babel/helper-explode-assignable-expression to address 1 CVE. Fixed in 7.18.9-tuxcare.3...
CLSA-2026-1792309331 TuxCare security update for @babel/helper-explode-assignable-expression (1 CVE)
TuxCare rebuilt @babel/helper-explode-assignable-expression to address 1 CVE. Fixed in 7.18.9-tuxcare.2...
Linux Distros Unpatched Vulnerability : CVE-2026-97229
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...
CVE-2026-111714
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...
EUVD-2026-103006
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...
CVE-2026-111714
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...
OESA-2026-4335 pcre2 security update
PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...
OESA-2026-4334 pcre2 security update
PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...
OESA-2026-4332 pcre2 security update
PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...
OESA-2026-4333 pcre2 security update
PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...