PT-2026-91200

A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse number expression of the file src/compiler/gravity parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. Th...

PT-2026-97770

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.1-tuxcare.2...

PT-2026-91177

Name of the Vulnerable Software and Affected Versions marcobambini Gravity versions prior to 0.9.8 Description A weakness in the JSON parser component, specifically within an unknown function in the src/utils/gravity json.c file, allows for remote memory corruption. Memory corruption occurs when ...

CVE-2026-90715: Integer Overflow or Wraparound

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravityjson.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclos...

PT-2026-91201

A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb clear parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be...

CVE-2026-54333: Out-of-bounds Write

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

CVE-2026-54334: Out-of-bounds Write

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen in uefifirmware/compression/Tiano/Decompress.c reads Number from GetBitsSd, CBIT with CBIT = 9 and can obtain 511 entries for the 510-element Sd-mCLen heap...

Important: python-mistune

Issue Overview: Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in...

Medium: jsoup

Issue Overview: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permi...

PT-2026-91456

Name of the Vulnerable Software and Affected Versions FFmpeg version 8.0.x Description A remote denial of service can be triggered through the manipulation of the duration or target duration arguments. This issue occurs within the parse playlist function located in the libavformat/hlsproto.c file...

CVE-2026-53496: Uncaught Exception

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

PT-2026-91239

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost versions 11.8.x through 11.8.4 Mattermost versions 11.7.x through 11.7.8 Mattermost versions 10.11.x through 10.11.22 Description The server-side Markdown parser fails to limit nesting depth. This allows an...

CVE-2026-86349: Inefficient Algorithmic Complexity

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.8, 10.11.x = 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service CPU resource exhaustion via a crafted post containing deeply nested...

PT-2026-91182

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been...

Important: wireshark

Issue Overview: C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76879 C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76886 Affected Packages: wireshark Note: This advisory is applicabl...

Amazon Linux 2023 : mod_auth_openidc (ALAS2023-2026-2155)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2155 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an...

Amazon Linux 2023 : python3-mistune (ALAS2023-2026-2148)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2148 advisory. Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens fro...

Amazon Linux 2023 : jsoup (ALAS2023-2026-2150)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2150 advisory. jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to...

The vulnerability of the pcapng file parser used by the Wireshark network traffic analyzer allows a hacker to cause a service failure.

The vulnerability of the pcapng file parser in the Wireshark network traffic analyzer is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow attackers to cause service failures...

Amazon Linux 2 : mod_auth_openidc (ALAS-2026-3920)

The version of modauthopenidc installed on the remote host is prior to 1.8.8-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3920 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements...