UBUNTU-CVE-2026-58470

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...

CVE-2026-58470

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.6), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.80.6) +17 more potentially affected by CVE-2026-53513 via @better-auth/sso (>=1.3.28, <=1.6.9)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

@access-dlsu/leapify (>=0.260531.1, <=0.260608.1), @agent-native/core (>=0.26.5, <=0.47.1) +218 more potentially affected by CVE-2026-67333 via better-auth (>=1.0.0, <=1.6.12)

better-auth NPM version =1.0.0, =0.260531.1, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =0.1.4 and more Source cves: CVE-2026-67333 Source advisory: OSV:GHSA-86J7-9J95-VPQJ...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-53514 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53514 Source advisory: OSV:GHSA-FMH4-WCC4-5JM3...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-53512 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53512 Source advisory: OSV:GHSA-PW9M-5JXM-XR6H...

CVE-2026-58470 GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...

CVE-2026-58470

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...

EUVD-2026-42082

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...

CVE-2026-58470 GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...

CVE-2026-58470

GNU Wget 1.25.0 and earlier is affected by an integer overflow in parse_content_range() (src/http.c) triggered by server-controlled Content-Range headers, leading to undefined behavior and download desynchronization. The issue is fixed in commit 43d3ba9, and users should upgrade to a version that...

CVE-2026-58470 GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...

CVE-2026-58470

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...

CVE-2026-58470

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigg...

@abtnode/analytics (>=1.16.13-beta-0086a35d, <=1.17.13-beta-20260613-094425-b81920c8), @abtnode/auth (>=1.3.13, <=1.17.13-beta-20260613-094425-b81920c8) +212 more potentially affected by CVE-2026-56812 via phoenix (>=1.7.2, <=1.7.21)

phoenix NPM version =1.7.2, =1.16.13-beta-0086a35d, =1.3.13, =1.1.12, =1.6.23, =1.16.6-beta-08670107, =1.0.0, =1.16.33-beta-20241105-141729-e4608175, =1.0.0, =1.0.35, =1.16.33-beta-20241105-141729-e4608175, =1.0.2, =1.16.33-beta-20241105-141729-e4608175, =1.16.33-beta-20241105-141729-e4608175,...

PYSEC-2026-1109 AIOHTTP has unicode match groups in regexes for ASCII protocol elements

Summary The parser allows non-ASCII decimals to be present in the Range header. Impact There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. ---- Patch:...

PYSEC-2026-1942 Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

Summary An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files e.g., StaticFiles or any use of...

PYSEC-2026-1788 Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass

Details There's a parsing logic error in picklescan and modelscan while trying to deal with opcode STACKGLOBAL. Function listglobals when handling STACKGLOBAL at position n, it is expected to track two arguments but in wrong range. The loop only consider the range from 1 to n-1 but forgets to...

PYSEC-2026-1558 LlamaIndex vulnerable to Path Traversal attack through its encode_image function

A path traversal vulnerability exists in run-llama/llamaindex versions 0.11.23 through 0.12.40, specifically within the encodeimage function in genericutils.py. This vulnerability allows an attacker to manipulate the imagepath input to read arbitrary files on the server, including sensitive syste...

@abtnode/analytics (>=1.16.13-beta-0086a35d, <=1.17.13-beta-20260613-094425-b81920c8), @abtnode/auth (>=1.3.13, <=1.17.13-beta-20260613-094425-b81920c8) +212 more potentially affected by CVE-2026-56812 via phoenix (>=1.7.2, <=1.7.21)

phoenix NPM version =1.7.2, =1.16.13-beta-0086a35d, =1.3.13, =1.1.12, =1.6.23, =1.16.6-beta-08670107, =1.0.0, =1.16.33-beta-20241105-141729-e4608175, =1.0.0, =1.0.35, =1.16.33-beta-20241105-141729-e4608175, =1.0.2, =1.16.33-beta-20241105-141729-e4608175, =1.16.33-beta-20241105-141729-e4608175,...