5959 matches found
CVE-2026-113793
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1...
CLSA-2026-1772815097 Fix of 104 CVEs
CVE-2025-38699 - scsi: bfa: Double-free fix CVE-2025-38699 CVE-2025-38697 - jfs: upper bound check of tree index in dbAllocAG CVE-2025-38697 CVE-2025-39823 - KVM: x86: use arrayindexnospec with indices that come from guest CVE-2025-39823 CVE-2025-39689 - ftrace: Also allocate and copy hash for...
AZL-109890 CVE-2026-114094 affecting package python-dulwich 0.21.7-6
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...
EUVD-2026-106897
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...
Jelmer Vernooij Dulwich path traversal vulnerability
Versions prior to Jelmer Vernooij Dulwich 1.2.9 contain a path traversal vulnerability. This vulnerability arises from the failure to validate DOS drive letter prefixes within Git tree path elements on Windows. It may allow attackers to bypass NTFS validation by using specially crafted malicious...
PT-2026-120664
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1...
CVE-2026-113670
Rejected reason: This CVE is a duplicate of another CVE...
CVE-2026-113670
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated...
CVE-2026-113670
The ApostropheCMS Node.js content management system is vulnerable to an authorization bypass in its core page REST API prior to version 4.33.0 . The issue stems from the use of .permission(false) in the getOne and all=1 tree dump handlers within packages/apostrophe/modules/@apostrophecms/page/ind...
EUVD-2026-105219
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated...
pypdf resource management error vulnerability
Versions of pypdf prior to 6.20.1 have a resource management error vulnerability. This vulnerability arises when deleting objects such as outline items from a specially crafted circular PDF tree, potentially leading to an infinite loop and blocking the current process...
CVE-2026-93085
A flaw was found in the ARM System Control and Management Interface SCMI firmware within the Linux kernel. This vulnerability occurs because the system fails to properly reject out-of-range Device Tree DT protocol identifiers. A local attacker could exploit this by providing a malformed 32-bit DT...
CLEANSTART-2026-PI70585 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree
CVE-2026-69153 affects multiple packages. PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. See references for individual vulnerability details...
CLEANSTART-2026-XV49388 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-OY76319 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-XD72038 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-IB35002 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
PT-2026-118585
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated...
CVE-2026-112406 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...