EUVD-2026-46133

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation...

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Summary Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has already exceeded maxHeaderSize and marked the frame truncated. At commit b2d2137c4404af425bf9d5d601a62576f5c06925, a 12,253-byte compressed SPDY header block can declare and inflat...

GHSA-MVH2-CRG5-V77C Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Summary Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has already exceeded maxHeaderSize and marked the frame truncated. At commit b2d2137c4404af425bf9d5d601a62576f5c06925, a 12,253-byte compressed SPDY header block can declare and inflat...

WordPress Header Footer Script Adder plugin <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Header Footer Script Adder versions = 2.1...

USN-8591-1 python-aiohttp vulnerabilities

Sean Gilligan discovered that AIOHTTP did not properly limit memory usage when processing HTTP headers and trailers. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. CVE-2026-22815 It was discovered that AIOHTTP did not properly...

USN-8591-1: AIOHTTP vulnerabilities

Sean Gilligan discovered that AIOHTTP did not properly limit memory usage when processing HTTP headers and trailers. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. CVE-2026-22815 It was discovered that AIOHTTP did not properly...

GO-2026-6040 Gitea: Webhook Authorization Header Returned in Plaintext via API in gitea.dev

Gitea: Webhook Authorization Header Returned in Plaintext via API in gitea.dev...

GO-2026-6051 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` in code.gitea.io/gitea

Gitea Docker image: REVERSEPROXYTRUSTEDPROXIES = default lets any source IP impersonate any user via X-WEBAUTH-USER in code.gitea.io/gitea...

CVE-2026-13089 OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self-alg$self-header-alg from the token's own header and then calls...

CVE-2026-14899

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...

CVE-2026-14899

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop through the rtpasffixheader function in libavformat/rtpdecasf.c. An attacker can exhaust CPU and prevent normal service by sending a crafted RTP/ASF stream containing ASF objects with a chunksize smaller than the 24-byte...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the spdifheaderdts4 function in libavformat/spdifenc.c. An attacker can read memory beyond the packet buffer by supplying a crafted DTS-HD stream with a coresize value larger than the actual packet length duri...

CVE-2026-14899

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...

CVE-2026-14899

Mozilla Thunderbird is vulnerable to an off-by-one error in the code used to parse MIME headers for display during message forwarding (active only if the setting to view all headers is enabled). This flaw allows a single byte to be read from memory following the header buffer, which could potenti...

CVE-2026-14899 Off-by-one out of bounds read in MIME header parser for forwarding

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...

CVE-2026-64834

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdecasf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtpasffixheader function fails to validate a minimum chunksize when...

Cleartext Storage of Sensitive Information

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the process that handles Google Service Account credentials, where the full PEM private key is placed in the JWT header's kid field instead of a key...

n8n: Google Service Account Private Key Exposed in JWT Header

Impact When n8n was configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field which should only have held a key identifier. Since JWT headers were Base64-encoded rather than encrypted, the key could be recovered by anything that...

NPM: n8n: Google Service Account Private Key Exposed in JWT Header

NPM: n8n: Google Service Account Private Key Exposed in JWT Header vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...