EUVD-2026-65290

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vcrawhtml shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vcrawhtml::render method, which base64-decodes shortcode content...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...

Linux Distros Unpatched Vulnerability : CVE-2026-19953

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host...

CVE-2026-65085: Improper Encoding or Escaping of Output

NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-55618: Improper Encoding or Escaping of Output

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the cleanfounduri function in emlparser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash,...

PT-2026-81503

NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

EulerOS Virtualization 2.13.1 : python-idna (EulerOS-SA-2026-3189)

According to the versions of the python-idna package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in...

PT-2026-81474

Name of the Vulnerable Software and Affected Versions eml parser versions prior to 3.0.2 Description The clean found uri function in eml parser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash, or period characters. This causes valid encoded URLs and...

Linux Distros Unpatched Vulnerability : CVE-2026-75899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authorit...

Mongoose http_cb() Code Execution

The vulnerability of the httpcb function in the Mongoose library is related to deficiencies in handling HTTP requests when processing the Transfer-Encoding parameter: chunked. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or execute...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization through the CONNECT and PUBLISH encoding paths in MqttEncoder and MqttCodecUtil. An attacker can send MQTT fields containing NUL bytes or wildcard characters by supplying crafted client identifiers, usernames, wi...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a heap overflow in NLnet Labs Unbound [CVE-2026-42944]

Summary IBM Watson Speech Services Cartridge is vulnerable to a heap overflow in NLnet Labs Unbound, due to an issue that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet CVE-2026-42944. NLnet Labs Unbound is used as part ...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to improper encoding in Apache Log4j [CVE-2026-49844]

Summary IBM Watson Speech Services Cartridge is vulnerable to Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API, which produces output that is not valid JSON CVE-2026-49844. Apache Log4j is included in our speech microservices. This...

vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths

When using the affected versions of the vibeio-http crate, an attacker could craft a malicious HTTP/1.x request with a large chunk length between usize::MAX - 1 and usize::MAX inclusive and send it, causing the server to crash integer overflow panic in debug builds, splitto out of bounds panic in...

GHSA-FX4F-MHW4-QM7J vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths

When using the affected versions of the vibeio-http crate, an attacker could craft a malicious HTTP/1.x request with a large chunk length between usize::MAX - 1 and usize::MAX inclusive and send it, causing the server to crash integer overflow panic in debug builds, splitto out of bounds panic in...

CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

EUVD-2026-65093

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76837

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...