PT-2026-132787

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB, GlobUtil.walkCB2, GlobUtil.walkCBSync, and GlobUtil.walkCB2Sync, invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout rejects or emits...

PT-2026-132795

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse, bnModInverse, lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's...

PT-2026-132810

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...

PT-2026-132811

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer, BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING...

PT-2026-132829

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into...

PT-2026-132833

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT SESSION TRACK was negotiated, the OkPacket.parse and OkPacket.parseWithInfo paths allocated byte arrays using server-declared lengths for th...

PT-2026-132834

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirmin...

CVE-2026-119207: py-pdf pypdf: pypdf is a free and open-source pure-python PDF library

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into...

PT-2026-132789

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

PT-2026-130631

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, nvm ls filters installed versions with a sed program that embeds the requested version pattern in a ... address, escaping . and, since 0.40.4, but not backslash....

PT-2026-132502

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH VERSION is set, so zsh...

PT-2026-132490

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download wheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled...

PT-2026-132492

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure dir for executable, library, and package directories, and ensure dir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

PT-2026-132489

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink app...

PT-2026-132460

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOW ALIGNMENT makes aligned linesize include row padding or an aligned offset before the first row. The resulting Arrow buffe...

PT-2026-132461

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self. size without rerunning Image. decompression bomb check. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an...

PT-2026-132467

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

PT-2026-132812

PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys get temp dir and reuses that directory without verifying it...

PT-2026-132823

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in /app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server c...

PT-2026-132844

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...