747797 matches found
Ghost: Regular Expression Denial of Service in Content Import
Impact A crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v4.0.0 up to v6.65.0. Patches v6.67.0 contains a fix for this issue. How to...
NPM: Ghost: Regular Expression Denial of Service in Content Import
NPM: Ghost: Regular Expression Denial of Service in Content Import vulnerability discovered by ? in WordPress Npm ghost versions = 4.0.0, 6.67.0...
EUVD-2026-93773
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS...
GHSA-CGC7-9QP3-86M3 Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Summary The HTML, JATS, ODS OpenDocument spreadsheet and BoxNote backends accept table rowspan / colspan values without an upper bound. A few bytes of input, such as , make docling run loops proportional to the declared span and allocate a table grid of the declared size. The result is CPU and...
GHSA-MCR4-QMVW-PX4G yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
Summary When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive...
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
Summary When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive...
GHSA-343H-94H5-C4WR yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
Summary When LZ4BlockInputStream is configured with stopOnEmptyBlock = false the mode for reading concatenated block streams, it handles each empty block by calling refill recursively. A long run of empty blocks exhausts the thread stack and throws StackOverflowError out of read or skip. Details ...
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs
Summary LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 inpu...
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request...
EUVD-2026-91674
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service...
GHSA-MCJ8-R9MP-W47P Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request...
NPM: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
NPM: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service vulnerability discovered by ? in WordPress Npm next versions = 15.0.0, 15.5.27...
EUVD-2026-93511
Payload: Incomplete validation during the upload file lifecycle...
Payload: Incomplete validation during the upload file lifecycle
Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...
GHSA-P223-2WR2-J562 Payload: Incomplete validation during the upload file lifecycle
Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...
Payload: Unauthenticated account-lockout denial of service
Impact An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in. You are affected if: Using an affected Payload version with an auth-enabled collection that uses local authentication and...
GHSA-V5GF-VPJC-PC7W Payload: Unauthenticated account-lockout denial of service
Impact An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in. You are affected if: Using an affected Payload version with an auth-enabled collection that uses local authentication and...
NPM: Payload: Unauthenticated account-lockout denial of service
NPM: Payload: Unauthenticated account-lockout denial of service vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...
GHSA-7822-RCF6-97FX RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
Summary A single AMQP message with malformed UTF-8 in a shortstr property for example correlation-id can permanently disable a Java client RPC consumer. The client decodes malformed bytes into U+FFFD replacement characters. Each of those re-encodes to 3 bytes, so a 255-byte property becomes 765...