OESA-2026-3910 wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. Security Fixes: GNU wget is...

EUVD-2026-83662

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

CVE-2026-81650

The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin, in versions before 4.5.0 , is vulnerable to an authenticated arbitrary file upload . The root cause is a logic error where a variable is reused as a loop counter, causing the plugin to fail to correctly validate t...

CVE-2026-81650: Unrestricted Upload of File with Dangerous Type

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

CVE-2026-82560: Loop with Unreachable Exit Condition

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap subtracts from the output width to get the space available for text. When that space...

AZL-103478 CVE-2026-93749 affecting package python-tensorboard 2.16.2-6

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

CVE-2026-93749

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

AZL-103442 CVE-2026-93749 affecting package js-jquery 3.5.0-4

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

DEBIAN-CVE-2026-93749

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

UBUNTU-CVE-2026-93749

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

CVE-2026-93749

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

CVE-2026-69184

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-93749 source-map-js through 1.2.1 Event Loop Denial of Service

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

CVE-2026-93749

source-map-js (through 1.2.1 ) fails to validate the per-section offset line value in indexed source maps, allowing a remote, unauthenticated attacker to supply an extremely large offset line value. This triggers synchronous event loop blocking for extended periods, preventing the service from ha...

CVE-2026-93749 source-map-js through 1.2.1 Event Loop Denial of Service

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

CVE-2026-93749 source-map-js through 1.2.1 Event Loop Denial of Service

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

EUVD-2026-83254

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

Infinite loop

Overview uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript. Affected versions of this package are vulnerable to Infinite loop via the removeDotSegments function, which loops infinitely when a path segment begins with Unicode line...

CVE-2026-69184 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-69184 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...