OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

UBUNTU-CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

CVE-2026-66037 FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

CVE-2026-66037 FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

CVE-2026-66036 FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the...

UBUNTU-CVE-2026-66034

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

GHSA-PM4M-PH32-GHV5 js-yaml: Exponential parsing time in flow collections leads to denial of service

Summary Parsing a small YAML document can take exponential time. An application that calls load or loadAll on untrusted input can be hung by a payload under 200 bytes. Details When an entry in a flow sequence turns out to be a key: value pair, the parser rewinds and parses that entry a second tim...

SUSE CVE-2026-16804

Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Summary A type confusion issue in seroval.fromJSON allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In applications...

GHSA-866W-XMHQ-WJ7X SvelteKit: Prototype pollution in file input deletion path in remote-function forms

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...

CVE-2026-64221

In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to...

CVE-2026-66007

CVE-2026-66007 affects HuggingFace Datasets (datasets) up to version 5.0.0. A path traversal vulnerability exists in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Crafting file_name values with directory tr...

CVE-2026-66007 Datasets Path Traversal via Unsanitized file_name Metadata

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the HTML encoding. An attacker can execute arbitrary code by supplying specially crafted input that is not properly sanitized. Remediation A fix was pushed into the master branch but not y...

EUVD-2026-48599

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS. This issue affects Website Template: before v2...

CVE-2026-8308

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS. This issue affects Website Template: before v2...