PT-2026-106133

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An Expression Language Injection issue exists when the...

PT-2026-104292

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description The D language bindings contain an integer underflow wrap or wraparound issue, which can lead to an uncaught exception and a loop with an unreachable exit condition, resulting in an infinite...

PT-2026-104080

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

Exploit for Expression Language Injection in Redhat Richfaces

RichFaces Paint2DResource — CVE-2018-12533 CTF lab A self-con...

PYSEC-2026-4056 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

PYSEC-2026-4059 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

GHSA-3JQQ-PW4J-PQCJ JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

EUVD-2026-89337

JupyterLab: Cross-site scripting XSS in JupyterLab via crafted language package jupyterlab.json...

CLEANSTART-2024-IK84393 attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse

CVE-2022-32149 affects multiple packages. An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. See references for individual vulnerability details...

thrift: thrift: Denial of Service via infinite loop in D language bindings

A flaw was found in Apache Thrift's D language bindings. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted input to an affected application. This input triggers an integer underflow or an unhandled exception, causing the process to enter an infini...

thrift: thrift: Denial of Service via excessive memory allocation

A flaw was found in Apache Thrift. Multiple language bindings fail to properly restrict memory allocation when processing input containing excessive size values. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, consuming available memory and...

thrift: thrift: Denial of Service via improper exception handling in TNonblockingServer

A flaw was found in Apache Thrift's D language implementation within the TNonblockingServer component. Due to improper handling of exceptional conditions and improper resource shutdown, an uncaught exception can occur during server operations. A remote, unauthenticated attacker could exploit this...

CVE-2026-86472 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, prism, opensearch-dashboards, yaml-language-server, vitess...

GHSA-HRR3-GC8F-F4QJ vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, prism, opensearch-dashboards, yaml-language-server, vitess...

[SECURITY] Fedora 43 Update: ty-0.0.84-1.fc43

An extremely fast Python type checker and language server, written in Rust...

[SECURITY] Fedora 43 Update: librabbitmq-0.18.0-1.fc43

This is a C-language AMQP client library for use with AMQP servers speaking protocol versions 0-9-1...

CLEANSTART-2026-QE04836 vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...

Security vulnerability affects the apache-nifi package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...