RockyLinux 10 : python3.14 (RLSA-2026:40856)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:40856 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

MiracleLinux 8 : python3-3.6.8-77.el8_10.ML.1 (AXSA:2026-1330:09)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1330:09 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding...

RockyLinux 9 : python3.14 (RLSA-2026:41949)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:41949 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

EUVD-2026-45551

fast-uri vulnerable to host confusion via literal backslash authority delimiter...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +29 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =1.0.0-next.27766, =12.1.0-rc.347 and more Source cves: CVE-2026-73569 Source advisory: GHSA-8R6M-32JQ-JX6Q...

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits vulnerability discovered by ? in WordPress Npm fast-xml-parser versions = 5.9.3, 5.10.1...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the addInputEntities function. An attacker can cause excessive...

GHSA-8R6M-32JQ-JX6Q fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +29 more potentially affected by unknown CVE via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =1.0.0-next.27766, =12.1.0-rc.347 and more Source cves: unknown CVE Source advisory: SNYK:JS-FASTXMLPARSER-18170229...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +29 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =1.0.0-next.27766, =12.1.0-rc.347 and more Source cves: CVE-2026-73569 Source advisory: OSV:GHSA-8R6M-32JQ-JX6Q...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the addInputEntities function. An attacker can...

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Summary The fix released in jackson-core 2.18.6 and 2.21.1 for GHSA-72hv-8253-57qq Number Length Constraint Bypass in Async Parser, published 2026-02-28 is incomplete. The fix commit b0c428e6 1555 wired validateIntegerLength into a new setIntLength helper and called it at every place where the...

GHSA-R7WM-3CXJ-WFF9 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Summary The fix released in jackson-core 2.18.6 and 2.21.1 for GHSA-72hv-8253-57qq Number Length Constraint Bypass in Async Parser, published 2026-02-28 is incomplete. The fix commit b0c428e6 1555 wired validateIntegerLength into a new setIntLength helper and called it at every place where the...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the NonBlockingUtf8JsonParserBase file. An attacker can exhaust system memory by streaming JSON input in small chunks to the asynchronous parser, causing unbounded accumulation of...

CVE-2026-65315 Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea's Debian package registry parser contains an unbounded decompression vulnerability in ParseControlFile. When processing an uploaded .deb file, the parser decompresses control.tar.gz and copies the entire uncompressed stream into a strings.Builder via a TeeReader, with no limit on how much...

colony-cli (>=1.2.13b0, <=1.3.0b0), cumulusci (>=3.32.0, <=3.32.1) +16 more potentially affected by CVE-2026-59890 via setuptools (54.2.0)

setuptools PYPI version 54.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - colony-cli =1.2.13b0, =3.32.0, =0.1.0, =0.1.0, =0.0.1, =2.0.0.dev4, =0.0.1, =0.0.3, =1.4.0b0, =1.1.3, =0.5.0, =0.5.1 and more Source cves:...

EUVD-2026-40093

fast-uri vulnerable to host confusion via failed IDN canonicalization...

SUSE CVE-2026-46671

Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted .onetoc2 table-of-contents file can cause Parser::parsenotebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads ent...