CVE-2026-18090

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image .icns file. The uncompress function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during...

CVE-2026-63376

A flaw was found in toml-node, a software library used for parsing TOML Tom's Obvious, Minimal Language files in Node.js and web applications. A remote attacker could exploit a vulnerability known as prototype pollution by providing specially crafted TOML input. This could allow the attacker to...

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...

multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...

EUVD-2026-69712

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy ke...

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Summary Hono's query parsing does not stop at the URL fragment: a ? appearing after a is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see. Details A fragment is never part of the query...

EUVD-2026-69236

xmldom: Quadratic-memory consumption...

NPM: xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

NPM: xmldom: Quadratic-time parsing via the malformed-input recovery path — parseElementStartPart re-scan and normalize adjacent-text merge vulnerability discovered by ? in WordPress Npm xmldom versions = 0.3.0, = 0.6.0...

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

Summary xmldom's malformed-input error-recovery path has two quadratic-time On² behaviors that a single crafted input triggers together, so a tiny, highly compressible document tens of KB stalls the Node.js event loop for multiple seconds. It is reachable from DOMParser.parseFromString under...

GHSA-2WM5-Q62R-HMRV Colord: Slow rejection of oversized malformed color strings

Impact colord's CSS color string matchers described a number as +-?\d.?\d+. In that form \d and \d+ can match the same digits, so a run of n digits can be divided between them in On² ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long...

CVE-2026-28609

In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-65221

GitPython: Arbitrary local file content disclosure via include directive in untrusted .gitmodules SubmoduleConfigParser never disables mergeincludes...

CVE-2026-72923

In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

CVE-2026-82056

A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been...

UBUNTU-CVE-2026-82056

A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been...