CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

CVE-2026-84645

Jenkins versions 2.579 and earlier (LTS 2.568.2 and earlier ) are vulnerable to a deserialization flaw. The root cause is that objects marked as PersistenceRoot types can be deserialized as nested field values in user-submitted config.xml documents. This allows an attacker with Item/Configure per...

EUVD-2026-70111

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

CVE-2026-84645

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

CVE-2026-84645

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

CVE-2026-84645

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

GHSA-6M44-FPC8-C3RQ Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

Summary Mistune v3.3.2 is vulnerable to a Denial of Service DoS attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with...

EUVD-2026-65137

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown...

GHSA-CW6X-M8JW-QMRH NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

Summary nltk.featstruct.FeatStructReader used by FeatStructstr and by FeatureGrammar.fromstring parses feature-structure strings such as a=1 with a recursive-descent parser that has no nesting-depth limit. A small, trivially-crafted input 700 bytes with deeply nested brackets drives the parser pa...

NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

Summary nltk.featstruct.FeatStructReader used by FeatStructstr and by FeatureGrammar.fromstring parses feature-structure strings such as a=1 with a recursive-descent parser that has no nesting-depth limit. A small, trivially-crafted input 700 bytes with deeply nested brackets drives the parser pa...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

PT-2026-84769

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

PT-2026-84768

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.580 Jenkins LTS versions prior to 2.568.3 Description Objects that store their configuration in independent top-level configuration files, such as jobs and global configuration, can be smuggled as nested field value...

GHSA-23W6-3W8W-8484 pypdf: Possible long runtimes/large memory usage when retrieving outlines

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths. Patches This has been fixed in pypdf==6.16.1...

Excessive Iteration

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Excessive Iteration in its document outline retrieval, which processes outline entries and nested outline paths without bounding t...

SUSE CVE-2026-72280

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context, as it is expected if FEATNV2 is advertised to the L1 hypervisor. Get rid of th...

SUSE CVE-2026-72287

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tprthreshold vs. the virtual APIC vTPR into the "normal" controls checks, as waiting until KVM has...

CVE-2026-81724

A flaw was found in NLTK. This uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader allows unauthenticated attackers to cause a denial of service. Attackers can achieve this by supplying deeply nested feature-structure input, which can lead to applications crashing when parsin...

CVE-2026-80699

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component for ARM64 architectures. This vulnerability, specifically affecting AmpereOne processors, occurs when a physical interrupt is double-deactivated in a nested virtualization context. An attacker could potentially...