850678 matches found
PT-2026-122410
Impact A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding for example gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one val...
PT-2026-122440
Impact When multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If a request is aborted for example when one file is rejected while another file's async fileFilter is still pending, the pending callback later resumes a parsing stream that multer h...
PT-2026-122215
The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dns resolve init locked - register dispatcher - dns dispatcher register, with the local port left at 0 so the stack picks an ephemeral port exactly once. dns...
PT-2026-122198
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cach...
PT-2026-122132
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...
PT-2026-122084
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud...
PT-2026-122431
Summary An allocation-without-limits vulnerability CWE-770 in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with IAC SB and then streams bytes without ever sending the IAC SE...
PT-2026-122420
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file like their pages where the same, but non-existent indirect object is referenced multiple times. Patches This has been fixed in pypdf==6.21.2. Workarounds If...
PT-2026-122412
Summary MLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke with no authentication, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional trulens + trulens-providers-litellm...
PT-2026-122427
Summary Wasmtime may panic when the host lowers a component model stream or future into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives ...
PT-2026-122417
Summary An unbounded-buffer vulnerability CWE-770 in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. twisted.words.protocols.irc.IRC.dataReceived appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum...
PT-2026-122218
Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An issue exists in the twisted.mail.imap4.IMAP4Server where the twisted.mail.imap4.parseNestedParens function can be reached with a negative literal size during an authenticated SEARCH command...
PT-2026-122418
On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...
PT-2026-122411
Summary An infinite-loop vulnerability CWE-835 in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. twisted.mail.imap4.parseNestedParens reads an IMAP literal size with int and never rejects a negative value. A negative size such as -100 drives...
PT-2026-121926
In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in virtio net hdr to skb Commit 9e8db5913264 "net: avoid false positives in untrusted gso validation" added a '&& skb-network header' check before flow-dissecting GSO packets without VIRTIO NET HDR...
Linux Distros Unpatched Vulnerability : CVE-2026-99071
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: do not warn on route notification size race Commit 680aea08e78c net: ipv4: Emit notification when fib hardware flags are changed added asynchronous route...
PT-2026-122439
Summary /api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so...
PT-2026-122437
Impact serialize-javascript escapes its output so it is safe to embed inside a element. Before 7.1.3 that guarantee did not hold for a function value whose source ends in a bare . A body ending exactly at followed by markup: js const serialize = require'serialize-javascript'; function f f.toStrin...
PT-2026-122413
Summary An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialise...
