Linux Distros Unpatched Vulnerability : CVE-2026-104712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal...

The vulnerability of the JSON processing library and stream-json, related to inadequate control over changes to prototype attributes, allows attackers to execute a “prototype pollution” attack.

The vulnerability of the JSON processing library and stream-json is related to inadequate control over changes to prototype attributes. Exploiting this vulnerability could allow an attacker to execute a “prototype pollution” attack...

UBUNTU-CVE-2026-104259

GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character after a comment terminator, bypassing rules...

Stack-based Buffer Overflow in Certificate Parsing Service of Brocade Fabric OS

: A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsing uploaded X.509 PEM certificates for management display, the system improperly validates the length of the Authority Key Identifier AKI extension before...

ROOT-OS-DEBIAN-12-CVE-2026-102010 CVE-2026-102010 in gcc-12 - Patched by Root

Root has patched CVE-2026-102010 in the gcc-12 package for Root:Debian:12. Multiple fixed versions available...

external_expat_AOSP10_r33_CVE-2022-25236

Expat, Release 2.2.6 This is Expat, a C library for parsing XML, started by James Clark in 1997. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in...

@0xsequence/codegenie (>=0.1.0, <=0.7.0), @2h2d/new (>=0.0.2, <=0.1.1-alpha.4) +1053 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.8.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =0.1.0, =1.0.0, =0.1.0, =4.10.0, =0.1.3, =0.1.0-beta.1, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R4XH-JQRQ-34V2...

EUVD-2026-90979

KaTeX: Existing prototype pollution can bypass trust restrictions...

CVE-2026-104712

A flaw was found in Apache Struts. An unauthenticated remote attacker could cause a Denial of Service DoS by sending requests with crafted decimal parameters that are rendered through the Struts tag library. Processing these values can produce disproportionately large server responses, enabling a...

@nx/express (>=23.0.0-beta.0, <=23.1.0), @nx/nest (>=23.0.0-beta.0, <=23.1.0) +1 more potentially affected by CVE-2026-104859 via @nx/docker (>=23.0.0, <=23.1.0-rc.3)

@nx/docker NPM version =23.0.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.1.0 Source cves: CVE-2026-104859 Source advisory: OSV:GHSA-6VC5-VF29-FFR2...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0-rc.87), @brabander/config-eslint (>=0.1.1, <=0.5.1) +175 more potentially affected by CVE-2026-104854 via nx (>=23.0.0, <=23.1.1)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.20.2, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.1.1 and more Source cves: CVE-2026-104854 Source advisory: OSV:GHSA-W3VV-58GJ-GW77...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0), @brabander/config-eslint (>=0.1.1, <=0.5.1) +177 more potentially affected by CVE-2026-104853 via nx (>=23.0.0, <=23.2.0-rc.2)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.4.0, =0.20.2, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.2.0 and more Source cves: CVE-2026-104853 Source advisory: OSV:GHSA-HRVQ-X7JP-36XV...

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

GHSA-8FXW-FMJ8-XP7J MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-75637

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-100723 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) potentially affected by CVE-2026-104871 via @angular/ssr (>=20.3.18, <=20.3.24)

@angular/ssr NPM version =20.3.18, =7.3.49-4369, =4.2.16-4435, =4.2.17 Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

3d-card (0.0.2), @cosla/sensemaking-web-ui (>=1.0.5, <=1.0.9) +19 more potentially affected by CVE-2026-104871 via @angular/ssr (>=19.0.5, <=19.2.27)

@angular/ssr NPM version =19.0.5, =1.0.5, =19.0.0-beta.1, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =0.0.2, =19.1.0, =16.0.0, =0.0.0, =0.0.0, =0.0.5 and more Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3007 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mongoose (>=0.31.0, <=0.66.0)

@opentelemetry/instrumentation-mongoose NPM version =0.31.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3312 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-pg (>=0.15.0, <=0.72.0)

@opentelemetry/instrumentation-pg NPM version =0.15.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...