CVE-2026-76833 @cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...

CVE-2026-76833

The @cgauge/yaml npm package has a custom YAML tag handler that unconditionally calls eval() on attacker-supplied string values during document parsing. Any application that parses untrusted YAML with this library exposes full Node.js runtime authority — environment variables, filesystem read/wri...

EUVD-2026-63350

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...

OESA-2026-3478 perl-DBI security update

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...

PT-2026-79260

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.1 Description The URLS regular expression in nltk/tokenize/casual.py, which is compiled into TweetTokenizer.WORD RE and used by TweetTokenizer.tokenize, contains an unbounded domain-label prefix. When processing inp...

PT-2026-79139

Name of the Vulnerable Software and Affected Versions @dicebear/core versions prior to 9.4.3 @dicebear/initials versions prior to 9.4.3 Description An issue exists where certain options are interpolated into SVG attributes without XML escaping. In @dicebear/core, the addRotate function fails to...

CVE-2026-75147

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer libavformat/rtpencav1.c. The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first...

CVE-2026-76221

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

MINI-VFXR-W83Q-P3J6

Bulletin has no description...

MINI-QQFX-M2HV-C4H4

Bulletin has no description...

MINI-J6X3-QMP9-W7JH

Bulletin has no description...

MINI-JFQW-Q62M-H2RW

Bulletin has no description...

CVE-2026-58081

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv3 to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer...

CVE-2026-58082 Stack based buffer overflow in iconv(3)

The ISO-2022 encoding module used a stack buffer sized to MBLENMAX 6 bytes for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four bytes. An application that uses iconv3 to...

CVE-2026-58082

This stack buffer overflow in FreeBSD's iconv(3) ISO-2022 encoding module occurs because an intermediate buffer is sized to MB_LEN_MAX (6 bytes) , while some ISO-2022 variants require up to 10 bytes per character , allowing overflow of up to four bytes. Any application using iconv(3) to convert u...

EUVD-2026-62349

The ISO-2022 encoding module used a stack buffer sized to MBLENMAX 6 bytes for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four bytes. An application that uses iconv3 to...

CVE-2026-58081 Heap based buffer overflow in iconv(3)

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv3 to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer...

CVE-2026-58081

CVE-2026-58081 is a buffer overflow in FreeBSD's iconv(3) library. The HZ, UTF-7, VIQR, and ZW encoding modules did not properly validate the caller-supplied output buffer size before writing converted characters, allowing an application converting untrusted input to overflow that buffer. Red Hat...

PT-2026-78556

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a schema default is emitted into a...

CVE-2026-75936

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...