SUSE-SU-2026:22845-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the configured data director bsc1271629. - CVE-2026-15043: DBI:SQL:Nano has incorrect predicate evaluation,...

EUVD-2026-46642

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

PT-2026-63528

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket on protocol error in the library lib/facil/http/parsers/websocket parser.h of the component WebSocket Frame Parser. This manipulation of the argument on message causes improper input validation. The attack...

📄 ThorVG SVG Parser NULL Pointer Dereference

A proof of concept exploit for ThorVG version prior to 1.0.5 demonstrates a NULL pointer dereference vulnerability in the SVG parser. A malformed, truncated child element within a root svg node causes createElement to return a NULL pointer which is subsequently dereferenced by parseStyle without...

RockyLinux 9 : python3.14 (RLSA-2026:41949)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:41949 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

RockyLinux 10 : python3.14 (RLSA-2026:40856)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:40856 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

MiracleLinux 8 : python3-3.6.8-77.el8_10.ML.1 (AXSA:2026-1330:09)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1330:09 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding...

EUVD-2026-45551

fast-uri vulnerable to host confusion via literal backslash authority delimiter...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +29 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =1.0.0-next.27766, =12.1.0-rc.347 and more Source cves: CVE-2026-73569 Source advisory: GHSA-8R6M-32JQ-JX6Q...

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits vulnerability discovered by ? in WordPress Npm fast-xml-parser versions = 5.9.3, 5.10.1...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the addInputEntities function. An attacker can cause excessive...

GHSA-8R6M-32JQ-JX6Q fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +29 more potentially affected by unknown CVE via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =1.0.0-next.27766, =12.1.0-rc.347 and more Source cves: unknown CVE Source advisory: SNYK:JS-FASTXMLPARSER-18170229...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +29 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =1.0.0-next.27766, =12.1.0-rc.347 and more Source cves: CVE-2026-73569 Source advisory: OSV:GHSA-8R6M-32JQ-JX6Q...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the addInputEntities function. An attacker can...

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Summary The fix released in jackson-core 2.18.6 and 2.21.1 for GHSA-72hv-8253-57qq Number Length Constraint Bypass in Async Parser, published 2026-02-28 is incomplete. The fix commit b0c428e6 1555 wired validateIntegerLength into a new setIntLength helper and called it at every place where the...

GHSA-R7WM-3CXJ-WFF9 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Summary The fix released in jackson-core 2.18.6 and 2.21.1 for GHSA-72hv-8253-57qq Number Length Constraint Bypass in Async Parser, published 2026-02-28 is incomplete. The fix commit b0c428e6 1555 wired validateIntegerLength into a new setIntLength helper and called it at every place where the...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the NonBlockingUtf8JsonParserBase file. An attacker can exhaust system memory by streaming JSON input in small chunks to the asynchronous parser, causing unbounded accumulation of...

CVE-2026-65315 Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...