25069 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-115927
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body dat...
Allocation of Resources Without Limits or Throttling
Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via readchunkedbody in http1connection.py, where reads of body data that has...
CVE-2026-116671
Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image...
CVE-2026-116581
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...
CVE-2026-116671
Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image...
UBUNTU-CVE-2026-116671
Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image...
CVE-2026-116581
The Seroval library (prior to version 1.6.8 ) is vulnerable to an unauthenticated Denial of Service (DoS) via the fromJSON and fromCrossJSON deserializers. The root cause is a lack of validation for a sequence node's done index; a crafted index can create an iterator that never finishes, causing ...
CVE-2026-116581
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...
AZL-111155 CVE-2026-65628 affecting package jose 14-3
josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...
DEBIAN-CVE-2026-65628
josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...
CVE-2026-65628
josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...
DEBIAN-CVE-2026-115927
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...
CVE-2026-115927
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...
CVE-2026-65628
josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...
UBUNTU-CVE-2026-65628
josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...
CVE-2026-115927
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...
UBUNTU-CVE-2026-115927
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...
CVE-2026-116671 Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder
Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image...
CVE-2026-116671
The software Xpdf version 4.06 and earlier is susceptible to an infinite loop vulnerability. The root cause is identified as improper input validation (CWE-20, CWE-835) specifically regarding the progression order field in a JPEG 2000 decoder . The impact is characterized by a low base severity (...
