AZL-110142 CVE-2026-87863 affecting package rust 1.75.0-31

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

AZL-110046 CVE-2026-87863 affecting package mysql 8.0.46-2

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

AZL-110307 CVE-2026-87863 affecting package tensorflow 2.16.1-11

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

DEBIAN-CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

AZL-110241 CVE-2026-87863 affecting package rust 1.96.1-2

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

AZL-109911 CVE-2026-87863 affecting package cmake 3.30.3-15

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

ALPINE-CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

Use of GET Request Method With Sensitive Query Strings

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Use of GET Request Method With Sensitive Query Strings

Overview @apostrophecms/passport-bridge is a Passport.js authentication for Apostrophe Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings via an unspecified vector in the package, allowing an authenticated attacker with low privileges to rea...

Allocation of Resources Without Limits or Throttling

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling which allows an unauthenticated remote attacker to create server-side upload state, write chunk data to...

3lc (>=2.3.84, <=2.11.2), a-data-processing (0.0.1) +295 more potentially affected by CVE-2026-112397 via pillow (10.2.0)

pillow PYPI version 10.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3lc =2.3.84, =0.2.3, =1.6.0, =0.21.0, =0.0.2, =0.0.1, =0.0.1, =24.2.0, =0.0.7, =1.0.3.dev0, =1.1.0 and more Source cves: CVE-2026-112397 Source...

EUVD-2026-104606

Pillow tiled-TIFF decoder reads past tile buffer in copy4 Unpack.c:1290...

CVE-2026-113602

A flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute 0x1A character followed by malformed content. This causes strict-mode validation checks to prematurely finish parsing and accept...

EUVD-2026-105319

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389 TFTP direction confusion

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389 TFTP direction confusion

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389

The libcurl library's TFTP state machine fails to validate state transitions against the requested transfer direction, allowing it to accept opening server responses for both reads and writes interchangeably. A malicious TFTP server can exploit this by responding to a download request in a way th...