CVE-2026-110753

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...

CVE-2026-110756

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-110757

Text::CSVXS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric...

CVE-2026-110754

Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never fre...

CVE-2026-110755

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-86227

A flaw was found in Valkey. An out-of-bounds read vulnerability exists in the kvstoreGetHashtable function within src/kvstore.c. This issue can be exploited by a remote attacker in cluster mode by providing a specially crafted dump.rdb file during application startup, for example, through data...

CVE-2026-67234

A flaw was found in rabbitmq-server. When clearing authentication preferences, the server generates a non-compliant cookie name containing invalid characters that standard web browsers reject when attempting deletion. This issue prevents the browser from properly removing the cookie, allowing sta...

CVE-2026-66078

A flaw was found in RabbitMQ. A remote authenticated user with administrative privileges can bypass account deletion safeguards by removing accounts using the bulk-delete API endpoint. Because this endpoint fails to check whether a user account has the protected tag, protected service accounts ca...

CVE-2026-110759

A flaw was found in Text::CSVXS. When parsing comma-separated values CSV input ending in a field separator followed by an unescaped carriage return CR character, the parser incorrectly records an end-of-file marker as input data, introducing an extraneous byte into the output field. An attacker w...

CVE-2026-110758

A flaw was found in Text::CSVXS. This vulnerability can lead to a Denial of Service DoS or memory corruption when processing specially crafted input. When whitespace stripping is enabled, parsing an unquoted field containing only blank spaces can cause the parser to read and overwrite memory...

CVE-2026-110757

A flaw was found in Text::CSVXS. An attacker can cause record splitting and data tampering by supplying input containing embedded newline characters that evaluates as numeric. Because the library fails to quote fields flagged as numeric when formatting Comma-Separated Values CSV records, the...

CVE-2026-110756

A flaw was found in Text::CSVXS. When printing records where a UTF-8 flagged field precedes invalid UTF-8 bytes, the module drops held-back bytes, closing quotes, and line endings without signaling an error. An attacker capable of providing crafted input can exploit this flaw to cause data...

CVE-2026-110754

A flaw was found in Text::CSVXS. When parsing a CSV record containing a syntax error, the getline function fails to release memory allocated for fields parsed prior to the failure. An attacker who can supply malformed CSV input to a long-running application can exploit this vulnerability to trigg...

CVE-2026-110755

A flaw was found in Text::CSVXS. This vulnerability allows an attacker to cause a Denial of Service DoS by providing specially crafted comma-separated value CSV input using carriage return CR-only line endings. Under default configuration settings, the parser repeatedly copies unparsed data acros...

CVE-2026-110753

A flaw was found in perl-text-csvxs. This flaw allows an attacker who supplies specially crafted CSV input to trigger a Denial of Service DoS. When processing CSV data configured with bound column variables, the parser improperly releases memory references upon encountering empty rows. Subsequent...

CVE-2026-67413

A flaw was found in rabbitmq-server. An authenticated user with permissions to bind and publish messages can cause a Denial of Service DoS by submitting specially crafted pattern-matching expressions to the Java Message Service JMS topic exchange plugin. Because the message broker evaluates these...

CVE-2026-67237

A flaw was found in rabbitmq-server. When Open Authorization OAuth is enabled for the management interface, the application fails to properly sanitize authentication tokens before embedding them into the bootstrap script. A remote attacker could exploit this cross-site scripting XSS vulnerability...

CVE-2026-67227

A flaw was found in rabbitmq-server. An authenticated remote user with policymaker privileges can cause a Denial of Service DoS by sending repeated HTTP requests with unique parameter names to the global parameters API endpoint. Because user-supplied parameter names are unsafely converted into...

CVE-2026-67230

A flaw was found in RabbitMQ. When the Web STOMP plugin is enabled, the WebSocket handler fails to enforce maximum frame size limits or login timeouts prior to client authentication. An unauthenticated remote attacker can exploit this vulnerability by sending a continuous stream of small frames t...

CVE-2026-67226

A flaw was found in rabbitmq-server. An authenticated user with administrative privileges can cause a Denial of Service DoS by submitting user definitions containing an excessive number of unique tag names. Because the application converts each tag string into an internal Erlang identifier that...