CVE-2026-73057 stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory...

AZL-96704 CVE-2026-73194 affecting package perl-DBI 1.651-1

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoisrc an...

UBUNTU-CVE-2026-73194

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoisrc an...

CVE-2026-73194 DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoisrc an...

CVE-2026-73194 DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoisrc an...

CVE-2026-74281

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipcupdatenametbl inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower upper ...

CVE-2026-72029

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. firsttableindex, nexttableindex, tablelength,...

CVE-2026-72119 can: bcm: extend bcm_tx_lock usage for data and timer updates

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

CVE-2026-15312

The CVE-2026-15312 entry concerns the Propovoice: All-in-One Client Management System WordPress plugin. Affected versions up to 1.7.8 are vulnerable to privilege escalation via the plugin’s REST create() endpoint, which fails to validate the user-supplied role against an allowlist and omits a pro...

PT-2026-72308

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm tx lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcm rx setup. Only copy the...

CVE-2026-46380

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

CVE-2026-46380 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

Open Redirect

Spring Security is vulnerable to Open Redirect. The vulnerability is due to CookieRequestCache and CookieServerRequestCache storing and using an unvalidated absolute URL from a browser cookie as the post-login redirect target, allowing an attacker to redirect users to a malicious destination...

WordPress Wallet System for WooCommerce plugin < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability

Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability discovered by takuma in WordPress Plugin Wallet System for WooCommerce versions 2.7.10...

CVE-2026-72678

Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to...

CVE-2026-19028

A flaw was found in HDF5. An attacker can craft a malicious HDF5 file with a specially designed Fletcher32-filtered chunk. When this file is processed, an integer underflow occurs due to insufficient size validation, leading to a massive out-of-bounds read. This vulnerability can cause the...

EUVD-2026-58252

Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to...

CVE-2022-4993 HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

CVE-2026-73509

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...