DEBIAN-CVE-2026-71430

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...

GHSA-8HCV-X26H-MCGP node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

Description WrappedRE2::Replace builds the replacement result and hands it to V8 with .ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the string/buffer exceeds its maximum length: lib/replace.cc v1.24.1: cpp // L553 — Buffer return path...

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

Description WrappedRE2::Replace builds the replacement result and hands it to V8 with .ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the string/buffer exceeds its maximum length: lib/replace.cc v1.24.1: cpp // L553 — Buffer return path...

MAL-2026-13439 Malicious code in commonweb-balance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7455a26ab96be134244f14c67b9e3fbf63033f1b974cf45ad0620d5a6eda0581 [email protected] is an empty shell package empty index.js, no functionality whose only effect on install is resolving its single declared...

EUVD-2026-53681

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node...

DEBIAN-CVE-2026-67870

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node...

UBUNTU-CVE-2026-67870

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

CVE-2026-70427 affects Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier. The root cause is unsafe handling of symbolic links with effectively empty names during extraction of .tar and .tar.gz archives, allowing an attacker who can supply crafted archives to write files to arbitrary location...

CVE-2026-54876

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

MINI-436X-868W-V65W

Bulletin has no description...

CVE-2026-54876

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

CVE-2026-54876 Client-Side Memory Leak in OCSP Response Checking

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

CVE-2026-54876 Client-Side Memory Leak in OCSP Response Checking

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

EUVD-2026-53385

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

CVE-2026-54876

CVE-2026-54876 describes a memory leak in TLS clients that enable OCSP response checking when interacting with a malicious TLS server. Specifically, if the server returns an OCSP response containing an empty BasicOCSPResponse (empty SEQUENCE OF SingleResponse), the OCSP_basicRESP structure alloca...

tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow

A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might...

CVE-2026-71277

Affected software: rust-iot-platform, specifically the AuthToken request-guard in api/src/main.rs. Vulnerability: the guard only checks for the presence of the Authorization header, with no validation against sessions, token stores, or signatures. Any non-empty header (e.g., Authorization: fake) ...