CVE-2026-71428

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...

CVE-2026-77031 Tenda CH22 formcreateFileName command injection

A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2026-77031

A command injection vulnerability exists in Tenda CH22 firmware version 1.0.0.1 . The affected element is the formcreateFileName function in the file /goform/formcreateFileName, where improper handling of the fileNameMit argument allows an attacker to inject and execute arbitrary commands. The at...

EUVD-2026-63486

A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2026-77031 Tenda CH22 formcreateFileName command injection

A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2026-71428 unstructured: Server-Side Request Forgery in the URL-based partitioning

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...

CVE-2026-71428 unstructured: Server-Side Request Forgery in the URL-based partitioning

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...

CVE-2026-71428 unstructured: Server-Side Request Forgery in the URL-based partitioning

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...

EUVD-2026-63472

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...

CVE-2026-71428

CVE-2026-71428 is a Server-Side Request Forgery (SSRF) in the unstructured Python library (versions 0.4.7 through 0.24.0 ). The url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.p...

CVE-2026-74300

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI component. A malicious Bluetooth controller could send a specially crafted response during the 'Read Local Codec Capabilities' operation. Insufficient validation of the codec capability element length could allow the...

CVE-2026-76997

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=savecategory. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The...

CVE-2026-76998

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=deletecategory. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack...

CVE-2026-75140

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

DEBIAN-CVE-2026-75140

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

CVE-2026-75140 jsoup Uncontrolled Resource Consumption in XmlTreeBuilder

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

CVE-2026-75140

jsoup (Java HTML/XML parser) versions through 1.23.2 contain an uncontrolled resource consumption vulnerability in the XmlTreeBuilder component. The root cause is that the builder copies the entire inherited namespace map on every start element, resulting in quadratic time and memory complexity ....

EUVD-2026-63476

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

CVE-2026-75140 jsoup Uncontrolled Resource Consumption in XmlTreeBuilder

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

CVE-2026-75140 jsoup Uncontrolled Resource Consumption in XmlTreeBuilder

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...