CVE-2026-58253

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

CVE-2026-58253

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

CVE-2026-54697

The DER parser used for application-supplied private keys did not safely validate encoded length values before converting them to "Int" values or allocating arrays. A malformed private-key file could encode a length that overflowed or wrapped around, or request an allocation much larger than the...

Security update for dracut

This update for dracut fixes the following issue CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: Update to version 059+suse.565.g682306ec5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...

SUSE-SU-2026:2803-1 Security update for dracut

This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: - Update to version 059+suse.565.g682306ec5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the inlineparser process. An attacker can cause excessive resource consumption by submitting input containing long sequences of double-asterisk or triple-asterisk emphasis pairs, leading to...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the blockparser process. An attacker can cause excessive CPU consumption by submitting specially crafted Markdown documents containing numerous repeated or distinct reference-link definitions...

PYSEC-2026-2216

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/blockparser.py and the reflinks environment dictionary handling, allowing denial of service...

PYSEC-2026-2213

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

DEBIAN-CVE-2026-59928

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/blockparser.py and the reflinks environment dictionary handling, allowing denial of service...

AZL-92211 CVE-2026-59928 affecting package python-mistune for versions less than 3.3.0-1

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/blockparser.py and the reflinks environment dictionary handling, allowing denial of service...

AZL-92217 CVE-2026-59925 affecting package python-mistune for versions less than 3.3.0-1

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...

CVE-2026-59924

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory wh...

CVE-2026-59928

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/blockparser.py and the reflinks environment dictionary handling, allowing denial of service...

CVE-2026-59927

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise...

AZL-92220 CVE-2026-59922 affecting package python-mistune for versions less than 3.3.0-1

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from ea...

colony-cli (>=1.2.13b0, <=1.3.0b0), cumulusci (>=3.32.0, <=3.32.1) +16 more potentially affected by CVE-2026-59890 via setuptools (54.2.0)

setuptools PYPI version 54.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - colony-cli =1.2.13b0, =3.32.0, =0.1.0, =0.1.0, =0.0.1, =2.0.0.dev4, =0.0.1, =0.0.3, =1.4.0b0, =1.1.3, =0.5.0, =0.5.1 and more Source cves:...

aos-prov (>=2.2.0.dev0, <=3.0.1), owasp-zap-historic-parser (0.1.7) +2 more potentially affected by CVE-2026-59890 via setuptools (47.3.2)

setuptools PYPI version 47.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - aos-prov =2.2.0.dev0, =0.4.0a2, =1.0.0, =1.0.2 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

CVE-2026-59930

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable tocN values without slugifying the heading text, allowing attacker-controlled id="tocN" content to collide with generated anchors and...

CVE-2026-59925

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...