CVE-2026-116171

SiYuan versions 3.5.4 before 3.8.7 on Windows are vulnerable to a sensitive-path denylist bypass in the IsSensitivePath function. This occurs because the Windows extended-length prefix (\? esting) survives the filepath.Clean operation and fails to match forbidden prefixes. Consequently, authentic...

PT-2026-123061

Name of the Vulnerable Software and Affected Versions HTTP::Server::PSGI versions prior to 1.0056 Description A remote attacker can crash the server by sending a single request with a large Content-Length and only a few body bytes. The server uses sysread calls sized by the remaining...

p5-Plack -- memory allocation vulnerability

Plack project reports: Fix HTTP::Server::PSGI allocating a buffer as large as the declared Content-Length, which let a single request crash the server with "Out of memory!" CVE-2026-115825...

DEBIAN-CVE-2026-114629

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

CVE-2026-114629

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

CVE-2026-114629 Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

EUVD-2026-109295

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

CVE-2026-114629

The Web::Simple module for Perl (versions before 0.035 ) is vulnerable to a memory allocation issue. The component Web::Dispatch::ParamParser::get_unpacked_body_from reads application/x-www-form-urlencoded bodies using a single read call without a cap. Because Perl's read function grows the buffe...

CVE-2026-114629 Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

CVE-2026-114629

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

CVE-2026-114629

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

CVE-2025-8471

CVE-2025-8471 SQL Injection PoC Author : Byte Reaper CVE : CVE-2025-8471 Vulnerability : SQL Injection in “projectworlds Online Admission System v1.0” Description : A blind SQL injection exists in adminlogin.php?aid=. This PoC sends a series of GET requests with various payloads—both two-stage...

Linux Distros Unpatched Vulnerability : CVE-2026-114629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters...

PT-2026-122604

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get unpacked body from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored...

SUSE CVE-2026-99066

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

Security Bulletin: IBM MQ Appliance is affected by an improper validation vulnerability (CVE-2026-12538)

Summary IBM MQ Appliance has addressed an improper validation vulnerability that could allow an authenticated attacker to obtain sensitive information or cause a denial of service. Vulnerability Details CVEID:CVE-2026-12538 DESCRIPTION: IBM MQ could allow an authenticated attacker to obtain...

CVE-2026-55606

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp size parameter. On little-endian hosts, this causes memcmp to read far...

DEBIAN-CVE-2026-99066

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99066

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99066 can: dev: init_can_skb(): restore skb header initialization

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...