CVE-2026-13149

The CVE-2026-13149 entry concerns the library brace-expansion up to version 5.0.6. The vulnerability is in the expand() function, which exhibits exponential-time complexity proportional to the number of consecutive non-expanding '{}' brace groups. This allows an attacker to craft input that cause...

CVE-2026-45822

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode function splits input on '%' producing N tokens and calls decodeComponents, exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately...

CVE-2026-45822

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode function splits input on '%' producing N tokens and calls decodeComponents, exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately...

CVE-2026-45822

CVE-2026-45822 – decode-uri-component : The connected records specify that the npm package decode-uri-component (versions up to 0.4.1) is vulnerable. The vulnerability lies in the decode() function, which splits input on '%' and then calls decodeComponents(), producing super-linear parsing time. ...

CVE-2026-45822

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode function splits input on '%' producing N tokens and calls decodeComponents, exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately...

CVE-2026-11979

A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially...

PYSEC-2026-597

NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue 3504. The UNSAFENOPROTOCOLRE regex in nltk/data.py checks for literal ../ sequences but fails to account for percent-encoded traversal sequences such as ..%2f. The url2pathname function decodes...

CVE-2026-58302

rtapiapp in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to lo...

qs: qs: Denial of Service via improper input validation in array parsing

A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation e.g., a=value. This bypasses the arrayLimit option, which is designed to limit the size of...

PT-2026-54094

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in Glic allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. A sandbox escape is a technique used to brea...

PT-2026-54133

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in the Speech component allows a remote attacker who has already compromised the renderer process to perform privilege escalation b...

CVE-2026-49432

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can...

PT-2026-53856

Name of the Vulnerable Software and Affected Versions Net::BitTorrent versions prior to 2.0.2 Description Remote memory exhaustion is possible through the processing of deeply nested bencoded input. The bdecode function recurses for each nested list or dictionary level without a depth limit. Duri...

PT-2026-54194

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input allows a remote attacker to bypass navigation restrictions. This occurs when a user is convinced to perform specific UI gestures while...

The vulnerability of the svc_rdma_copyInline_range() function in the net/sunrpc/xprtrdma/svc_rdma_rw.c module of the Linux operating system’s RPC protocol implementation allows a attacker to gain access to protected information or cause service failures.

The vulnerability of the svcrdmacopyInlinerange function in the net/sunrpc/xprtrdma/svcrdmarw.c module of the Linux operating system’s RPC protocol is related to an improper check of the specified index, position, or offset in the input data. Exploiting this vulnerability could allow an attacker ...

Axis Communications AXIS OS Improper Validation of Syntactic Correctness of Input (CVE-2024-6173)

A researcher in the AXIS OS Bug Bounty Program has found that a Guard Tour VAPIX API parameter accepted arbitrary values, which could let an attacker block access to the guard tour configuration page in the web interface of the Axis device. Axis has released patched AXIS OS versions for this flaw...

Linux Distros Unpatched Vulnerability : CVE-2026-46606

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine glances/plugins/vms/engines/virsh.py...

PT-2026-54126

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in Chromoting allows a local attacker to potentially perform a sandbox escape via a malicious file. A sandbox escape is a technique used to...

PT-2026-54425

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in the Speech component allows a remote attacker who has compromised the renderer process to perform UI spoofing through a crafted HTML page. ...

PT-2026-54358

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in HTML allows a remote attacker to perform Universal Cross-Site Scripting UXSS, which is a vulnerability that enables the execution of...