xmldom: HTML raw-text closing-tag case mismatch causes output amplification

Summary In HTML mode text/html, a raw-text element script, style, textarea, title whose closing tag differs in case from its opening tag e.g. for is mishandled by the parser, producing quadratic On² output growth — a small crafted document parses and serializes into output orders of magnitude...

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Summary An improper CRLF neutralization flaw in Predis' pipeline handling on aggregate connections lets an unauthenticated attacker who can influence any pipelined argument — a value or a key, e.g. a URL slug used as a cache key — smuggle arbitrary Redis commands into the connection. - On cluster...

Colord: Slow rejection of oversized malformed color strings

Impact colord's CSS color string matchers described a number as +-?\d.?\d+. In that form \d and \d+ can match the same digits, so a run of n digits can be divided between them in On² ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long...

GHSA-2WM5-Q62R-HMRV Colord: Slow rejection of oversized malformed color strings

Impact colord's CSS color string matchers described a number as +-?\d.?\d+. In that form \d and \d+ can match the same digits, so a run of n digits can be divided between them in On² ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long...

EUVD-2026-70251

HTTPX2: Streaming response decompression does not bound peak memory decompression amplification...

GHSA-8XX6-HGC6-GC2M HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

GHSA-F2FP-RGF2-35CP HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

Summary HTTPX2's Server-Sent Events SSE parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this...

EUVD-2026-70242

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service...

EUVD-2026-69216

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions...

CVE-2026-81991

Acrobat Reader is affected by an out-of-bounds read vulnerability (CWE-125) that could lead to disclosure of sensitive memory . Exploitation requires user interaction : a victim must open a malicious file. The CVSS 3.1 score is 5.5 (Medium) , reflecting a local attack vector with low complexity, ...

CVE-2026-81991 Acrobat Reader | Out-of-bounds Read (CWE-125)

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

EUVD-2026-74113

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

EUVD-2026-74112

Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-81980

Adobe Acrobat Reader is affected by an out-of-bounds write (CWE-787) vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction : a victim must open a malicious file. The vulnerability is scored CVSS 3.1: 7.8 (HIGH) with a ...

CVE-2026-81980 Acrobat Reader | Out-of-bounds Write (CWE-787)

Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-79910 Acrobat Reader | Out-of-bounds Read (CWE-125)

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

EUVD-2026-74109

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-79910

Acrobat Reader is affected by an out-of-bounds read vulnerability (CWE-125) that can lead to disclosure of sensitive memory . Exploitation requires user interaction — a victim must open a malicious file. The CVSS 3.1 score is 5.5 (MEDIUM) , reflecting a local attack vector with required user inte...

CVE-2026-81981 Acrobat Reader | Out-of-bounds Write (CWE-787)

Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...