CVE-2018-11761

Summary In a recent research on Apache Tika, I found a DOS Denial of Service vulnerability existed on its XML parser. It is caused that the parser improperly parses XML document. Affected Version Tested on ElasticSearch 6.3.1 using Tika 1.18 and 6.2.3 using Tika 1.17 Analysis As we know, the core...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-104825)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104825 advisory. A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists...

GO-2026-5074 Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git

Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git...

Authentication Bypass by Assumed-Immutable Data

Overview Affected versions of this package are vulnerable to Authentication Bypass by Assumed-Immutable Data via improper parsing in the ASP.NET Core Negotiate authentication handler. An attacker can elevate privileges by supplying crafted authentication data that is parsed incorrectly, allowing...

SUSE CVE-2026-31637

In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkaddecryptticket decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether cryptoskcipherdecrypt succeeded. A malformed RESPONSE can...

Linux kernel 安全漏洞

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from improper parsing of the TID-To-Link Mapping element, potentially leading to out-of-bounds reads...

SUSE CVE-2026-1801

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soupfilterinputstreamreadline logic, where libsoup accepts malformed chunk headers, such as lone line feed LF characters instead of the required...

libnbd 参数注入漏洞

libnbd is an open source library from libguestfs for editing NBD Network Block Device clients. A parameter injection vulnerability exists in libnbd, which stems from incorrect parsing of a specially crafted URI and could lead to arbitrary code execution...

Remote Code Execution (RCE)

vllm is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper parsing of tool call inputs, which allows an attacker to execute arbitrary code through crafted payloads...

CVE-2025-12613: Improper Neutralization of Argument Delimiters in a Command

Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a variety of malicious outcomes, such as bypassing...

EUVD-2006-6284

Malware in sbrugna...

EUVD-2017-7341

Malware in sbrugna...

EUVD-2024-49613

Malicious code in bioql PyPI...

EUVD-2022-51432

Malicious code in bioql PyPI...

phonenumber 安全漏洞

phonenumber is a Whisperfish open source library for parsing, formatting and validating international phone numbers. A security vulnerability exists in phonenumber versions prior to 1.2.2 that stems from the phonenumbers.Parse function not properly validating input syntax, which could lead to an...

NewStart CGSL MAIN 7.02 : xdg-utils Vulnerability (NS-SA-2025-0195)

The remote NewStart CGSL host, running version MAIN 7.02, has xdg-utils packages installed that are affected by a vulnerability: - When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not...

CVE-2020-6655

The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the application. The vulnerability arises du...

h11: h11 accepts some malformed Chunked-Encoding bodies

A flaw was found in the h11. This vulnerability allows request smuggling via improper parsing of chunked-coding message bodies, where h11 fails to validate the required \r\n terminators...

Cross-site Scripting (XSS)

golang.org/x/net is vulnerable to improper parsing logic. The vulnerability is due to incorrect tag interpretation in unquoted attribute values ending with a solidus / being mistakenly marked as self-closing, especially in foreign content like or . which allows attackers to exploit content in the...

HTTP Request Smuggling

github.com/clickhouse/ch-go is vulnerable to HTTP Request Smuggling. The vulnerability is due to improper parsing or handling of HTTP requests. Specifically, the vulnerability arises from the way large, uncompressed malicious external data is processed, allowing an attacker to smuggle an addition...