frony-document-processor (0.3.0), vllm-plugin-meralion2 (>=0.1.2.post2.dev1, <=0.1.2.post2) +1 more potentially affected by CVE-2026-1839 via transformers (4.50.1)

transformers PYPI version 4.50.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - frony-document-processor 0.3.0 - vllm-plugin-meralion2 =0.1.2.post2.dev1, =1.0.0rc1, =1.0.0rc2 Source cves: CVE-2026-1839 Source...

frony-document-processor (0.3.0), vllm-plugin-meralion2 (>=0.1.2.post2.dev1, <=0.1.2.post2) +1 more potentially affected by CVE-2026-1839 via transformers (4.50.1)

transformers PYPI version 4.50.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - frony-document-processor 0.3.0 - vllm-plugin-meralion2 =0.1.2.post2.dev1, =1.0.0rc1, =1.0.0rc2 Source cves: CVE-2026-1839 Source...

PT-2026-30814

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 17.0 through 28.4.2, 26.2.5.19, and 27.3.4.10 Description An incorrect authorization issue exists in Erlang OTP inets modules that allows unauthenticated access to CGI scripts protected by directory rules when served via...

EUVD-2025-209235

N/A...

CVE-2026-35035 CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.2.0, the application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative...

CVE-2026-34148

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or...

CVE-2026-34148 Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or...

CVE-2026-34148

CVE-2026-34148 – Fedify resource exhaustion via unbounded redirects . Affected: @fedify/fedify (Fedify) before versions 1.9.6, 1.10.5, 2.0.8, 2.1.1. Description in connected docs confirms that the remote and authenticated document loaders recursively follow HTTP 3xx redirects without a maximum re...

Adobe Experience Manager DOM-Based XSS

The vulnerability of the Adobe Experience Manager content and media data management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute a DOM-Based XSS attack remotely...

PT-2026-30656

Name of the Vulnerable Software and Affected Versions: Fedify versions prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1 Description: Fedify does not enforce a maximum redirect count or visited-URL loop detection when following HTTP redirects in its remote and authenticated document loaders. An attacker...

CVE-2026-34148: Uncontrolled Resource Consumption

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or...

MINI-RQ9R-RCJJ-3546

Bulletin has no description...

MINI-GHJJ-P693-CRRW

Bulletin has no description...

MINI-65H9-9WJG-9J9X

Bulletin has no description...

MINI-WP9X-WGHQ-56JP

Bulletin has no description...

PT-2026-30697

Name of the Vulnerable Software and Affected Versions StrongBox in Android versions prior to security patch level 2026-04-05 Description StrongBox in Android before security patch level 2026-04-05 contains a High Severity issue. The issue is identified as A-434039170, A-467765081, A-467765894, an...

SUSE CVE-2026-3308

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdfloadimageimp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code executio...

MINI-4F7J-G33C-23P2

Bulletin has no description...

GHSA-2M67-WJPJ-XHG9 Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers

Summary Jackson Core 3.x does not consistently enforce StreamReadConstraints.maxDocumentLength. Oversized JSON documents can be accepted without a StreamConstraintsException in multiple parser entry points, which allows configured size limits to be bypassed and weakens denial-of-service...

Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers

Summary Jackson Core 3.x does not consistently enforce StreamReadConstraints.maxDocumentLength. Oversized JSON documents can be accepted without a StreamConstraintsException in multiple parser entry points, which allows configured size limits to be bypassed and weakens denial-of-service...