EUVD-2026-110630

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...

CVE-2026-116589

A flaw was found in ddtrace. This issue allows a remote attacker to cause a denial of service DoS when Interactive Application Security Testing IAST is enabled. Specifically, the string-processing instrumentation fails to handle internal errors during old-style string formatting operations. By...

CVE-2026-116588

A flaw was found in dd-trace-py. The default regular expression used for query-string obfuscation can encounter excessive backtracking when processing input for HTTP tracing metadata. A remote attacker can exploit this vulnerability by submitting specially crafted URL query strings, resulting in...

guardrebind

Fooling LLM Safety Guards into Judging the Wrong Text Code, data and every raw score for the paper paper/main.pdf, source in paper/. LLM safety guards receive the content they review by plain string interpolation into their grading prompt, so content that imitates the guard's own prompt format ca...

VulnCheck KEV: CVE-2026-114509

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowin...

PT-2026-127226

Name of the Vulnerable Software and Affected Versions dd-trace versions 2.0.0 through 5.131.0 dd-trace versions 6.0.0 through 6.20.0 Description A regular expression used to obfuscate URL query strings can cause excessive backtracking when processing specific attacker-controlled input. This occur...

PT-2026-125882

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or ∴ becomes query string syntax instead of data, so a caller-supplied key name can add parameters ...

PT-2026-127759

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

CVE-2026-116588

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...

CVE-2026-116589

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process...

CVE-2026-116589 Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process...

CVE-2026-116589

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process...

CVE-2026-116589

The Datadog dd-trace-py Python APM client (versions 3.13.0 through 4.15.5 ) contains a vulnerability in its IAST string-processing instrumentation . The root cause is the failure to properly handle internal errors during old-style % string formatting when processing attacker-controlled input. If ...

CVE-2026-116589 Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process...

CVE-2026-116589 Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process...

CVE-2026-116588 Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...

CVE-2026-116588 Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...

CVE-2026-116588

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can...

CVE-2026-116588

The Datadog dd-trace-py Python APM client (versions 1.5.0 through 3.19.9 and 4.15.6) is vulnerable to a Regular Expression Denial of Service (ReDOS) . The flaw exists in the default query-string obfuscation regular expression, which can undergo excessive backtracking when synchronously processing...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the chat template rendering engine, which processes user-supplied Jinja2-style templates...