CVE-2026-107168

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service DoS for the affected application...

curl: Cookie attribute truncation in curl drops Secure/HttpOnly protections

Description: If a Set-Cookie header contains an = immediately after a semicolon i.e., ;=, curl stops parsing the attributes and discards everything that follows. This silently drops protections like Secure and HttpOnly, causing curl to later send the cookie over unencrypted HTTP. Root Cause: In...

CVE-2026-107168: Loop with Unreachable Exit Condition

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service DoS for the affected application...

Linux Distros Unpatched Vulnerability : CVE-2026-107167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after- free condition during input-method state transitions...

Linux Distros Unpatched Vulnerability : CVE-2026-107169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text...

PT-2026-107535

A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. Thi...

PT-2026-107496

A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null...

CVE-2026-107167: Use After Free

A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. Thi...

CVE-2026-107169: NULL Pointer Dereference

A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Service DoS...

CVE-2026-107170: NULL Pointer Dereference

A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null...

PT-2026-107495

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service DoS for the affected application...

PT-2026-107536

Name of the Vulnerable Software and Affected Versions m17n-lib affected versions not specified Description A flaw in the text processing mechanism allows an attacker to provide specially crafted or truncated UTF-8 input. This triggers an unhandled null pointer dereference, which is a condition...

Incomplete List of Disallowed Inputs

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the lookupProperty function in lib/handlebars/runtime.js, which returns the resolved value as soon as...

Incomplete List of Disallowed Inputs

Overview org.webjars.npm:handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the lookupProperty function in lib/handlebars/runtime.js, which returns the resolved value as soon as...

CVE-2026-106512

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

CVE-2026-106444

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

CVE-2026-106444

The Handlebars templating engine (versions 4.0.0 through 4.7.10 ) is vulnerable to JavaScript Injection due to improper escaping in the Handlebars.precompile() function. Specifically, lib/handlebars/compiler/code-gen.js uses quotedString() to emit static template text without escaping sequences t...

CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

Cross-site Scripting (XSS)

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the quotedString function in lib/handlebars/compiler/code-gen.js, which writes static template text into the JavaScript that Handlebars.precompi...

Cross-site Scripting (XSS)

Overview org.webjars.npm:handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the quotedString function in lib/handlebars/compiler/code-gen.js, which writes static template text into the JavaScript that...