UBUNTU-CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-63384 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX becom...

EUVD-2026-63495

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73258

In Mongoose prior to 7.22, mg_http_next_multipart() in src/http.c uses an incorrect AND condition when scanning for CRLF terminators in multipart input. A lone carriage return or line feed causes premature truncation of headers, filenames, or boundaries, allowing an attacker to present a misleadi...

CVE-2026-73258 Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-72847 broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-40345

deepmerge-ts

CVE-2026-40345 deepmerge-ts: Stack exhaustion when merging recursive object graphs

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

CVE-2026-18308 GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

CVE-2026-18287 Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-18287

aeon (Python time series library, aeon-toolkit/aeon) is vulnerable to code injection in the load_time_series_segmentation_benchmark method. The root cause is the lack of proper validation of a user-supplied string before it is used to execute Python code, allowing an attacker to run arbitrary cod...

CVE-2026-63039

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

tmp: path Traversal via unsanitized prefix/postfix enables directory escape

A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the...

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifical...

grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation

A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote...

CVE-2026-63039 Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...

CVE-2026-63039 Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...