GHSA-QW6M-8FW2-2V64 Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...

GHSA-GF8H-GQ53-288J OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

UBUNTU-CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

CVE-2026-66037 FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

CVE-2026-66037 FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

CVE-2026-66037 FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

CVE-2026-66036 FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the...

UBUNTU-CVE-2026-66034

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

js-yaml: Exponential parsing time in flow collections leads to denial of service

Summary Parsing a small YAML document can take exponential time. An application that calls load or loadAll on untrusted input can be hung by a payload under 200 bytes. Details When an entry in a flow sequence turns out to be a key: value pair, the parser rewinds and parses that entry a second tim...

GHSA-PM4M-PH32-GHV5 js-yaml: Exponential parsing time in flow collections leads to denial of service

Summary Parsing a small YAML document can take exponential time. An application that calls load or loadAll on untrusted input can be hung by a payload under 200 bytes. Details When an entry in a flow sequence turns out to be a key: value pair, the parser rewinds and parses that entry a second tim...

SUSE CVE-2026-16804

Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Summary A type confusion issue in seroval.fromJSON allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In applications...

GHSA-866W-XMHQ-WJ7X SvelteKit: Prototype pollution in file input deletion path in remote-function forms

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...

Out-of-bounds Read

Overview onnx is an Open Neural Network Exchange Affected versions of this package are vulnerable to Out-of-bounds Read in the adaptgemm76 function when processing input tensors with fewer than two dimensions. An attacker can cause a crash or potentially leak adjacent heap memory by providing a...

ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

Summary Heap-buffer-overflow READ 16 bytes in Gemm76::adaptgemm76 onnx/versionconverter/adapters/gemm76.h:41 when ConvertVersion processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses Bshape1 without checking rank. On Release builds the OOB read ...