Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

SummaryThe local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...

PYSEC-2026-4286 Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Summary The local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...

CLEANSTART-2026-NL77468 Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy

Security vulnerability affects the grafana-fips package. Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...

CVE-2026-100349: NULL Pointer Dereference

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation f...

PT-2026-115101

undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields...

PT-2026-114980

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.146.0 Description In the openapi3filter.ValidateResponse function, a nil response header schema is passed to decodeValue when an OpenAPI document declares a header using content instead of a schema. Although the...

EUVD-2026-101608

DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvid...

CVE-2026-92153

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

CVE-2026-102085

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due to a wrong initialization, a process whi...

CVE-2026-92153

The F´ (F Prime) framework, used for spaceflight and embedded software, contains an arbitrary file write vulnerability in Svc::FileUplink prior to version 4.3.0 . The root cause is that the system copies the destinationPath from Fw::FilePacket::StartPacket and opens it for writing without canonic...

CVE-2026-92153 F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

CVE-2026-92153 F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

CVE-2026-102085

A vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause limited information disclosure and availability impact . The root cause is an Improper Restriction of Communication Channel to Intended Endpoints (CWE-923) resulting from a wrong initia...

EUVD-2026-101456

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due to a wrong initialization, a process whi...

CVE-2026-102085 Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due to a wrong initialization, a process whi...

CVE-2026-73130

Gitea versions

CVE-2026-73130 Gitea repository initialization resource exhaustion

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can...

awesome-latency-attacks

Awesome Deep Learning Latency Attacks & Defenses This repository is maintained as a companion resource for the survey “Deep Learning Latency Attacks and Defenses: A Cross-Domain Survey.” It indexes papers, code links, taxonomy notes, and figures on latency-oriented availability threats in deploye...

ROS-20261014-73-0004

The vulnerability of the function ieee80211prepconnection in the net/mac80211/mlme.c module of the mac80211 stack in the Linux operating system is related to the dereferencing of a pointer whose validity period has expired. Exploiting this vulnerability could allow an attacker to compromise the...

Juniper Junos OS Multiple Vulnerabilities (JSA112171)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA112171 advisory. - An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-base...