CLSA-2026-1793790276 TuxCare security update for glob (1 CVE)

TuxCare rebuilt glob to address 1 CVE. Fixed in 10.5.0-tuxcare.1...

Interlace

Interlace Easily turn single threaded command line applications into a fast, multi-threaded application with CIDR and glob support. Reviews / Howto Guides Interlace: A Tool to Easily Automate and Multithread Your Pentesting & Bug Bounty Workflow Without Any Coding Table of Contents Setup Usage -...

minimatch: minimatch: Denial of Service via crafted glob pattern expansion

A flaw was found in minimatch. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS through excessive CPU and memory consumption. By supplying a specially crafted glob expression, an attacker can trigger repetitive pattern segment expansion during compilation at...

minimatch: minimatch: Denial of Service via crafted glob pattern expansion

A flaw was found in minimatch. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS through excessive CPU and memory consumption. By supplying a specially crafted glob expression, an attacker can trigger repetitive pattern segment expansion during compilation at...

minimatch: minimatch: Denial of Service via crafted glob pattern expansion

A flaw was found in minimatch. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS through excessive CPU and memory consumption. By supplying a specially crafted glob expression, an attacker can trigger repetitive pattern segment expansion during compilation at...

CVE-2025-10952-ml-logger-AFR

CVE-2025-10952 — ml-logger streamhandler Arbitrary File Read This repository provides a standalone Python script — CVE-2025-10952.py — that exploits an unauthenticated arbitrary file read vulnerability in ml-logger's streamhandler, chained with the /glob endpoint for filesystem enumeration. When...

EUVD-2026-113273

minimatch has potential denial of service via globparts amplification...

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background. The root cause is that abort branches in src/walker.ts call cb without returning. As a result, callers that rely on signal or AbortSignal.timeout to bound glob...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the walkCB, walkCB2, walkCBSync, and walkCB2Sync methods of src/walker.ts, where each abort branch calls cb without returning. An attacker can keep a walk consuming filesystem I/O...

npm: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

npm: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal vulnerability discovered by ? in WordPress npm glob versions = 9.0.0, = 14.0.1...

GHSA-3G3M-2FJR-6PW4 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background. The root cause is that abort branches in src/walker.ts call cb without returning. As a result, callers that rely on signal or AbortSignal.timeout to bound glob...

EUVD-2026-113329

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal...

CLEANSTART-2024-DW33743 Uncontrolled recursion in Glob in path/filepath before Go 1

Security vulnerability affects the go package. Uncontrolled recursion in Glob in path/filepath before Go 1...

CLEANSTART-2024-HY52810 Uncontrolled recursion in Glob in io/fs before Go 1

Security vulnerability affects the go package. Uncontrolled recursion in Glob in io/fs before Go 1...

CLEANSTART-2026-DE87336 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the argo-workflows package. Picomatch is a glob matcher written JavaScript...

CLEANSTART-2026-LP66230 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the argo-workflows package. Picomatch is a glob matcher written JavaScript...

CVE-2026-119720

Blender versions before 4.5.15 and 5.x before 5.2.3 are vulnerable to a heap out-of-bounds read in the read_file_dna() function. The flaw occurs because the software fails to validate the declared length of a GLOB block field. An attacker can exploit this by providing a crafted .blend file with a...

CVE-2026-119720 Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in readfiledna that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds rea...

CLEANSTART-2026-HF83772 Picomatch is a glob matcher written JavaScript

CVE-2026-33672 affects multiple packages. Picomatch is a glob matcher written JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-ZY80781 Picomatch is a glob matcher written JavaScript

CVE-2026-33671 affects multiple packages. Picomatch is a glob matcher written JavaScript. See references for individual vulnerability details...