CVE-2022-36163

CVE-2022-36163 Suggested description A format string vulnerability was found in pdftoroff hovacui 1.1.0 pdf reader. A user can control the second parameter to sprintf which can lead to DoS or Information Disclosure for more attacks. sprintfcommand, output-postsave, fileno, fileno; Additional...

CVE-2026-58458

Don't Starve Together Steam AppID 322330 through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted worldgendata with an invalid Kle...

CVE-2026-116269

The MIME::Field::ParamVal module in Perl (versions before 5.521 ) contains a vulnerability where certain RFC 2231 filenames with hyphenated language tags are incorrectly processed. Specifically, when a parameter like filename*=utf-8'en-US'payload.exe is parsed, the decoder fails to resolve the co...

CVE-2026-58458 Don't Starve Together Memory Corruption via world_gen_data

Don't Starve Together Steam AppID 322330 through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted worldgendata with an invalid Kle...

EUVD-2026-112278

Don't Starve Together Steam AppID 322330 through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted worldgendata with an invalid Kle...

CVE-2026-58458

The game Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder . A remote attacker operating a public dedicated server can crash a victim's game client by publishing crafted world_gen_data with an invalid...

EUVD-2026-111399

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

PT-2026-128349

Don't Starve Together Steam AppID 322330 through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world gen data with an invalid...

CVE-2026-58458: Out-of-bounds Write

Don't Starve Together Steam AppID 322330 through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted worldgendata with an invalid Kle...

CVE-2026-104016 jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...

CVE-2026-78661

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

GO-2026-6860 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

CVE-2026-114509

CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials 🔴 CVE-2026-114509 — Laravel TokenGuard Authentication Bypass Unauthenticated Authentication Bypass in Laravel Framework — TokenGuard API Guard 📋 Overview CVE-2026-114509 is a critical authentication bypass...

dd-trace: ReDOS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

GHSA-X94G-W73Q-HPCW dd-trace: ReDOS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

npm: dd-trace: ReDOS in URL query string obfuscation

npm: dd-trace: ReDOS in URL query string obfuscation vulnerability discovered by ? in WordPress npm dd-trace versions = 2.0.0, 5.131.1...

CVE-2026-116693 dd-trace: ReDOS in URL query string obfuscation

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a...

CVE-2026-116693

The dd-trace Datadog APM client for Node.js is vulnerable to a Regular Expression Denial of Service (ReDoS) in the URL query string obfuscation logic. Specifically, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking when processing attacker-controlled URL quer...

CVE-2026-116693 dd-trace: ReDOS in URL query string obfuscation

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...