90803 matches found
arches (8.0.0a1), avaintegration-metapackage (>=6.0.4.3, <=6.0.8.45) +53 more potentially affected by CVE-2026-84429 via django (>=6.0.0a1, <=6.0.8)
django PYPI version =6.0.0a1, =6.0.4.3, =3.1.0, =2.0.0, =1.1.0, =1.2.1 and more Source cves: CVE-2026-84429 Source advisory: SNYK:PYTHON-DJANGO-20825027...
arches (8.0.0a1), avaintegration-metapackage (>=6.0.4.3, <=6.0.8.45) +53 more potentially affected by CVE-2026-87890 via django (>=6.0.0a1, <=6.0.8)
django PYPI version =6.0.0a1, =6.0.4.3, =3.1.0, =2.0.0, =1.1.0, =1.2.1 and more Source cves: CVE-2026-87890 Source advisory: SNYK:PYTHON-DJANGO-20825029...
arches (8.0.0a1), avaintegration-metapackage (>=6.0.4.3, <=6.0.8.45) +53 more potentially affected by CVE-2026-87975 via django (>=6.0.0a1, <=6.0.8)
django PYPI version =6.0.0a1, =6.0.4.3, =3.1.0, =2.0.0, =1.1.0, =1.2.1 and more Source cves: CVE-2026-87975 Source advisory: SNYK:PYTHON-DJANGO-20825028...
CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
EUVD-2026-95254
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
CVE-2026-106435
The MongoDB Python Driver contains an out-of-bounds read vulnerability in its binary accelerator. This occurs when an application decodes malformed BSON containing a truncated regular-expression element missing a trailing NUL byte. An attacker who can supply BSON to the decode or decode_all APIs ...
CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
music-metadata: Uncontrolled memory allocation in APEv2 parser
Summary music-metadata 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser. The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes. A small crafted .ape fi...
GHSA-53V6-4H7P-P4GJ music-metadata: Uncontrolled memory allocation in APEv2 parser
Summary music-metadata 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser. The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes. A small crafted .ape fi...
GHSA-5GFJ-9Q3V-QFP3 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
Summary The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer VINT element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and Uint8Array...
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
Summary The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer VINT element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and Uint8Array...
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
Description When escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session's NOBACKSLASHESCAPES SQL mode. The server status flag was declared STATUSNOBACKSLASHESCAPES but never read. Under a...
GHSA-R3RV-JM3R-62Q2 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
Description When escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session's NOBACKSLASHESCAPES SQL mode. The server status flag was declared STATUSNOBACKSLASHESCAPES but never read. Under a...
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length a...
GHSA-48QF-XH34-Q73R MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length a...
Use of Uninitialized Resource
Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the GeoJSON Polygon and MultiPolygon encoding path in lib/cmd/encoder/binary-encoder.js when a ring element within the coordinates array is not a real array. The encoder sizes the output buffer using...