321909 matches found
CVE-2026-68499
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...
CVE-2026-55777
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...
CVE-2026-55777 GoAccess: Out-of-bounds heap read in parse_ios() via crafted User-Agent leads to remote crash/DoS
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...
EUVD-2026-51306
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...
CVE-2026-55777
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...
CVE-2026-55777
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...
EUVD-2026-51300
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parsebrowser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Age...
CVE-2026-68499
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...
CVE-2026-68499 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...
CVE-2026-68499
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...
CVE-2026-68499 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...
CVE-2026-68499
CVE-2026-68499 concerns the re2 Node.js bindings. Affected component is the String.prototype.match implementation in re2 when using a global RE2 pattern that can match the empty string. The underlying issue is that the native matching cursor is not advanced in lib/match.cc, causing an infinite lo...
CVE-2026-59881
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...
CVE-2025-36374 IBM DataPower Gateway affected by XML external entity injection
IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...
EUVD-2025-210545
IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...
CVE-2025-36374 IBM DataPower Gateway affected by XML external entity injection
IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...
CVE-2025-36374
IBM DataPower Gateway is affected by CVE-2025-36374 due to an XML External Entity (XXE) vulnerability (CWE-611). The issue occurs when processing XML data and could allow a privileged user to expose sensitive information or exhaust memory. Affected products/versions include DataPower Gateway 10.6...
openjdk: OpenJDK: Enhance AWT ImagingLib (Oracle CPU 2026-07)
A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...
CVE-2026-59881
AIOHTTP WebSocket client vulnerability: before 3.14.2, the client accepts and decompresses frames with RSV1 set even when permessage-deflate was not negotiated, enabling potential CPU and memory overuse by a malicious server. Affected: AIOHTTP (WebSocket client). Root cause: decompressing frames ...