CVE-2026-71429 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token...

EUVD-2026-66715

amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload...

GHSA-6C5V-HQJR-5XXP amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

Summary A vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-laye...

amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

Summary A vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-laye...

CVE-2026-85052

A flaw was found in Google Chrome's CrashReporting component. A remote attacker, after compromising the renderer process, could exploit an out-of-bounds read vulnerability by crafting a malicious HTML page. This could lead to information disclosure, allowing the attacker to read memory outside of...

CVE-2026-19795

IBM Qiskit SDK versions 2.1.0 through 2.5.1 are vulnerable to a denial of service when deserializing QPY files . The root cause is improper handling of a specially crafted object during deserialization, which may overflow the available stack space and trigger a segmentation fault , crashing the a...

CVE-2026-19795 Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.

Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input...

CVE-2026-19795 Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.

Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input...

Security Bulletin: Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.

Summary A maliciously constructed QPY payload that contains specifically constructed ParameterExpression objects as part of the payload can trigger a segfault in the evaluation of those expressions during deserialization. The function qiskit.qpy.load may recurse too deeply and overflow the...

EUVD-2026-70214

TOON: Prototype pollution when decoding untrusted TOON input...

CVE-2026-85050

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85050

CVE-2026-85050 is an out-of-bounds write in the WebGL component of Google Chrome on Android , affecting versions prior to 152.0.7977.82 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the sandbox , yielding a CVSS 3.1 score of 9.6 (CRITICAL) with scope...

CVE-2026-85050

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85052

Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85052

CVE-2026-85052 is an out-of-bounds read in the CrashReporting component of Google Chrome prior to 152.0.7977.82 . A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to read memory outside the browser's security sandbox, resulting in information dis...

EUVD-2026-70703

Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85052

Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-82298

Incorrect Authorization CWE-863 in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

Security Bulletin: MongoDB Enterprised Advanced affected by: Uncontrolled Recursion (CVE-2026-45205)

Summary There are vulnerabilities in commons-configuration2-2.10.1.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-45205. The vulnerability has/vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in...

CVE-2026-82298

Kibana (Elastic) is affected by an Incorrect Authorization flaw (CWE-863) that can lead to denial of service when access control security levels are incorrectly configured (CAPEC-180). The CVSS 3.1 score is 4.3 (MEDIUM) with a network vector, low complexity, low privileges required, and low avail...