asf__karaf_CVE-2022-22932_4-3-5

Apache Karaf Apache Karaf is a modulith runtime, supporting several frameworks and programming model REST/API, web, spring boot, .... It provides turnkey features that you can directly leverage without effort, packaged as mutable or immutable application. Overview Hot deployment : Karaf supports...

CVE-2026-119143

A flaw was found in Wasmtime. Untrusted WebAssembly guest code can trigger a Denial of Service DoS by executing zero-length stream read or write operations with unvalidated memory addresses. This improper validation causes the host runtime to panic and unexpectedly terminate, crashing the host...

CVE-2026-119136

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...

CVE-2026-7003: WIT SynApps Runtime: WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers…

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed...

PT-2026-134133

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as...

CVE-2026-119332: LadybirdBrowser ladybird: Ladybird is a truly independent web browser

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from mrecords, retained an iterator to the next FinalizationRecord, and then invoked...

CVE-2026-7005: WIT SynApps Runtime: WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows…

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as...

Linux Distros Unpatched Vulnerability : CVE-2026-119136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders...

Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-3374)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3374 advisory. Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. CVE-2026-114148 Out-of-bounds write in .NET allows an unauthorized attacker to execut...

PT-2026-133789

Name of the Vulnerable Software and Affected Versions WIT SynApps Runtime versions prior to 1.4.12 Description Hardcoded credentials allow unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in the...

CVE-2026-7004: WIT SynApps Runtime: WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that…

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this...

UBUNTU-CVE-2026-119136

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...

PT-2026-133790

Name of the Vulnerable Software and Affected Versions WIT SynApps Runtime versions prior to 1.4.12 Description A pre-authentication reflected cross-site scripting issue exists where unauthenticated attackers can inject and execute arbitrary JavaScript. This is achieved by submitting a crafted LIN...

moc3ingbird

Future Work Future work in this space will occur under theSakura Motion organization, beginning with our Core rewrite: https://github.com/SakuraMotion/PurismCore. MOC3ingbird DoS 日本語版：READMEJA.md This repository contains a simple Live2D model that crashes any application that attempts to load it:...

CVE-2026-119208 pypdf: Possible long runtimes/large memory usage for encrypted PDF files

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trust...

CVE-2026-119206

The pypdf Python PDF library is vulnerable to uncontrolled resource consumption (CWE-400) in versions prior to 6.21.3 . A crafted PDF containing a flat page-label number tree with many ranges can cause the page_labels property to take excessive time. This occurs because the property resolves each...

CVE-2026-119206 pypdf: Possible long runtimes when retrieving page labels

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The pagelabels property resolves each page independently and repeatedly scans the same /Num...

Security Bulletin: eMudhra CA Certificate Compromise (CVE-2026-91403 and CVE-2026-114820)

Summary Private keys for eight eMudhra intermediate CA certificates have been compromised. All versions of IBM® Semeru Runtimes are affected. Vulnerability Details CVEID:CVE-2026-114820 DESCRIPTION: Vulnerability in Java SE component: JSSE. Easily exploitable vulnerability allows unauthenticated...

io.hyte.platform:hyte-db (>=4.4.6.hyte-24470, <=4.4.11.hyte-26354), io.hyte.platform:hyte-mq (>=4.4.6.hyte-24470, <=4.4.11.hyte-26354) +13 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (22.0.4)

org.keycloak:keycloak-policy-enforcer MAVEN version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - io.hyte.platform:hyte-db =4.4.6.hyte-24470, =4.4.6.hyte-24470, =4.4.6.hyte-24470,...

CVE-2026-119136

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...