pypdf: Possible long runtimes/large memory usage when parsing indirect objects

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace. PatchesThis has been fixed in pypdf==6.18.0. WorkaroundsIf you cannot upgrade yet, consider applying th...

PYSEC-2026-4153 pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace. Patches This has been fixed in pypdf==6.18.0. Workarounds If you cannot upgrade yet, consider applying...

pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace. Patches This has been fixed in pypdf==6.18.0. Workarounds If you cannot upgrade yet, consider applying...

GHSA-5JQ2-8X83-X246 pypdf: Possible long runtimes/large memory usage when parsing indirect objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace. Patches This has been fixed in pypdf==6.18.0. Workarounds If you cannot upgrade yet, consider applying...

CVE-2025-41753 Path traversal in dynamically created BACnet File Objects

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the...

CVE-2025-41753

A path traversal vulnerability exists in dynamically created BACnet File Objects . The system fails to perform sufficient validation on the object name, which is interpreted as a file path. This allows an unauthenticated remote attacker to use relative paths to traverse outside the intended direc...

CVE-2025-41753 Path traversal in dynamically created BACnet File Objects

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the...

CVE-2026-92548 WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters

The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / etc (crlsa-2024_3061)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243061 advisory. jackson-databind: denial of service via a large depth of nested objects CVE-2020-36518 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_8060)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258060 advisory. firefox: Out-of-bounds access when resolving Promise objects CVE-2025-4918 firefox: Out-of-bounds access when optimizing linear sums CVE-2025-4919 Tenable...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc (crlsa-2022_7128)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227128 advisory. postgresql: Extension scripts replace objects not belonging to the extension. CVE-2022-2625 Tenable has extracted the preceding description block directly from the...

Rocky Linux 9 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2023_1591)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20231591 advisory. webpack: avoid cross-realm objects CVE-2023-28154 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus ha...

Rocky Linux 10.0 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_8125)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258125 advisory. firefox: Out-of-bounds access when resolving Promise objects CVE-2025-4918 firefox: Out-of-bounds access when optimizing linear sums CVE-2025-4919 Tenab...

AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.2:CLSA-2025:1760018305)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760018305 advisory. - jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects...

Rocky Linux 8 [CIQ] Security Update: opencryptoki / opencryptoki-debuginfo / opencryptoki-debugsource / etc (crlsa-2026_26352)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626352 advisory. openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects CVE-2026-40253 Tenable has extracted the...

Rocky Linux 9 [CIQ] Security Update: opencryptoki / opencryptoki-ccatok / opencryptoki-ccatok-debuginfo / etc (crlsa-2026_28256)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202628256 advisory. openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects CVE-2026-40253 Tenable has extracted the...

Rocky Linux 10.2 [CIQ] Security Update: opencryptoki / opencryptoki-debuginfo / opencryptoki-debugsource / etc (crlsa-2026_28231)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202628231 advisory. openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects CVE-2026-40253 Tenable has extracted th...

GitPython submodule update path traversal can write outside the repository

Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...

GHSA-59CR-6R3X-644W GitPython submodule update path traversal can write outside the repository

Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...

CVE-2026-102994 pypdf: Possible long runtimes/large memory usage when parsing indirect objects

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/reader.py and pypdf/generic/base.py to scan excessive input through...