EUVD-2026-66717

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

CVE-2026-62249 Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

CVE-2026-62249 Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

CVE-2026-62249 Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

Security Bulletin: Security vulnerability affects IBM® SDK, Java™ Technology Edition (CVE-2026-16440)

Summary Security vulnerability has been addressed in IBM® SDK, Java™ Technology Edition. Vulnerability Details CVEID:CVE-2026-16440 DESCRIPTION: In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault. CWE:CWE-674: Uncontrolled...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-55620

A flaw was found in emlparser, a Python module designed for parsing email files. A remote attacker can exploit a vulnerability in how the module processes Received: headers containing deeply nested parentheses. By submitting specially crafted email files, an attacker can cause excessive CPU usage...

CVE-2026-55619

A flaw was found in emlparser, a Python module for parsing email files. A remote attacker can exploit this vulnerability by sending a specially crafted email containing deeply nested comments within its headers. This malicious input can exhaust the parser's call stack, leading to a RecursionError...

SUSE SLED15: libblkid-devel / libblkid-devel-static / libblkid1 / etc (SUSE-SU-2026:3684-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3684-1 advisory. - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456:...

IBM Java 7.1 < 7.1.5.31 / 8.0 < 8.0.8.70

The version of IBM Java installed on the remote host is 7.1 prior to 7.1.5.31 / 8.0 prior to 8.0.8.70. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update August 2026 advisory. - In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested...

PT-2026-82300

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

CVE-2026-80185 Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

CVE-2026-55099

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child...

GHSA-CV84-9P8J-FJ68 icalendar has Algorithmic Complexity in Equality

Summary Component.eq compares subcomponents in O2^n time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components ==...

CVE-2026-55099 icalendar: Algorithmic Complexity in Equality

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child...

CVE-2026-55099 icalendar: Algorithmic Complexity in Equality

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child...

CVE-2026-55099

icalendar is an RFC 5545 iCalendar parser and generator for Python. In versions 7.1.0 through 7.1.3 , the Component equality method in src/icalendar/cal/component.py compares nested subcomponents using two membership loops that recursively invoke the same method on child components, producing O(2...

CVE-2026-55620

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.routing.noparenthesis in emlparser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based...

GHSA-G7GC-GMGP-WGQG eml_parser vulnerable to DoS via deeply nested parens in Received headers

Summary emlparser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes 1.3 seconds of CPU saturation per parsed message;...

eml_parser vulnerable to DoS via deeply nested parens in Received headers

Summary emlparser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes 1.3 seconds of CPU saturation per parsed message;...