2171 matches found
CVE-2026-48484 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...
Security Bulletin: Security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak
Summary A security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. JavaScript is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fix...
CVE-2026-48484: Improper Input Validation
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...
PT-2026-108984
Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev101 Description The rpc function in api blueprint.py handles multipart/form-data uploads by reading the entire content of the uploaded file into memory using file.read before sending the data to the underlyi...
CVE-2026-85486
Brocade ASCG versions prior to 3.5.0 are vulnerable to Remote Code Execution (RCE) due to improper input processing. The software evaluates form data before performing necessary validation. An authenticated user with basic access can submit a configuration form containing crafted input , which th...
CVE-2026-85486
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code...
CVE-2025-55182-React2Shell-Async-Scanner
⚡ React2Shell CVE-2025-55182 / CVE-2025-66478 - Async RCE Scanner Prototype-pollution → Remote Code Execution via React Server Actions Async, version-first, output-based canary detection - no blind guessing !WARNING For authorised security research and penetration testing only. Scanning systems...
Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-76905 DESCRIPTION: kin-opena...
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...
GHSA-X8MW-P69M-V3MX @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...
AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2025:1758102713)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758102713 advisory. - Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses Math.random to choose...
Rocky Linux 10.0 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc (crlsa-2025_8135)
The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258135 advisory. tornado: Tornado Multipart Form-Data Denial of Service CVE-2025-47287 Tenable has extracted the preceding description block directly from the CIQ security...
Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (crlsa-2025_8254)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258254 advisory. rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser CVE-2025-46727 tornado: Tornado Multipart Form-Data Denial of Service CVE-2025-47287 Tenable has...
AlmaLinux 9.2 [TuxCare] Security Update: libmicrohttpd / libmicrohttpd-devel / libmicrohttpd-doc (ALMALINUX9.2:CLSA-2025:1760026053)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760026053 advisory. - GNU libmicrohttpd before 0.9.76 allows remote DoS Denial of Service due to improper parsing of a multipart/form-data boundary in the...
Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772617597)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772617597 advisory. - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to...
CLEANSTART-2026-FQ89941 form-data is a library for creating readable multipart/form-data streams
Security vulnerability affects the argo-workflows package. form-data is a library for creating readable multipart/form-data streams...
CLEANSTART-2026-IW41585 Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP)
Security vulnerability affects the argo-workflows package. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP...