GHSA-6VVC-X485-93V7 pypdf: Possible long runtimes/large memory usage when retrieving form fields

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR...

pypdf: Possible long runtimes/large memory usage when retrieving form fields

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR...

SUSE CVE-2026-113789

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell CVE-2026-109618 / CVE-2026-109619 Two critica...

CVE-2026-113872 multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is...

CVE-2026-113872 multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is...

CVE-2026-113872

The multer middleware for Node.js (versions 2.0.0 before 2.5.0 ) is vulnerable to a Denial of Service (DoS) . When configured with an asynchronous fileFilter , an aborted request can leave a pending callback that resumes a torn-down parsing stream. This causes the parser to emit an error on a str...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell — Universal Exploit for CVE-2026-109618 / CVE-2026-1...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell — CVE-2026-109618 / CVE-2026-109619 Proof-of-concep...

CVE-2026-112379

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68...

CVE-2026-112379 WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68...

EUVD-2026-108053

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68...

CVE-2026-112379

The Codepeople Contact Form Email (contact-form-to-email) WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.3.68 . The flaw stems from the Improper Neutralization of Input During Web Page Generation , which allows an attacker to inject malicious...

CVE-2026-103234

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided us...

CVE-2026-103234 WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided us...

EUVD-2026-108009

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided us...

CVE-2026-103234

The WP Ultimate Review WordPress plugin (versions before 2.4.5 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is a failure to neutralise shortcodes in specific review fields submitted via the plugin's public review form. An unauthenticated visitor can submit a r...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell !Authorhttps://img.shields.io/badge/Author-l3tc...

WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form formerly Sexy Contact Form before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute...

CLEANSTART-2026-KI18725 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...