Lucene search
+L

22225 matches found

OSV
OSV
added 2026/08/04 2:52 p.m.5 views

CLSA-2026-1774225193 TuxCare security update for yargs-parser (1 CVE)

TuxCare rebuilt yargs-parser to address 1 CVE. Fixed in 11.1.1-tuxcare.1...

5.3CVSS6.8AI score0.00514EPSS
SaveExploits1
CVE
CVE
added 2026/08/04 2:39 p.m.114 views

CVE-2026-68494

This CVE notes an incomplete fix for CVE-2026-18401 in jackson-core’s non-blocking parser, leaving a remaining bypass for number-length constraints when data is streamed in many small chunks. The issue arises in the async parser path (MINOR_NUMBER_INTEGER_DIGITS) where validateIntegerLength() is ...

8.7CVSS5.6AI score0.00372EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/08/04 2:39 p.m.7 views

EUVD-2026-52703

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

8.7CVSS5.6AI score0.00372EPSS
SaveExploits0References7
Vulnrichment
Vulnrichment
added 2026/08/04 2:39 p.m.8 views

CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

8.7CVSS5.6AI score0.00372EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/08/04 2:39 p.m.36 views

CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

8.7CVSS0.00372EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 2026/08/04 2:39 p.m.8 views

CVE-2026-68494

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

8.7CVSS5.6AI score0.00372EPSS
SaveExploits0References8Affected Software1
OSV
OSV
added 2026/08/04 2:39 p.m.41 views

CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

8.7CVSS5.6AI score
SaveExploits0References11
EUVD
EUVD
added 2026/08/04 2:23 p.m.8 views

EUVD-2026-52699

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

6.9CVSS5.7AI score0.0031EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/04 2:23 p.m.35 views

CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

6.9CVSS0.0031EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/04 2:23 p.m.5 views

CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

6.9CVSS5.7AI score
SaveExploits0References7
CVE
CVE
added 2026/08/04 2:23 p.m.41 views

CVE-2026-18401

The CVE describes a vulnerability in jackson-core’s non-blocking (async) JSON parser where maxNumberLength is not enforced, unlike the synchronous parser. Root cause: the async parsing path in NonBlockingUtf8JsonParserBase does not invoke number length validation; _finishNumberIntegralPart() accu...

6.9CVSS5.7AI score0.0031EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/08/04 1:15 p.m.10 views

Important: Red Hat Security Advisory: python3 security update

An update for python3 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

8.7CVSS5.6AI score0.00637EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/04 1:15 p.m.5 views

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

8.7CVSS5.5AI score0.00637EPSS
SaveExploits0References11
RedHat Linux
RedHat Linux
added 2026/08/04 1:10 p.m.7 views

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

8.7CVSS5.4AI score0.00637EPSS
SaveExploits0References11
Rockylinux
Rockylinux
added 2026/08/04 12:1 p.m.7 views

mingw-glib2 security update

An update is available for mingw-glib2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GLib provides the core application building blocks for libraries and...

9.8CVSS7AI score0.00839EPSS
SaveExploits7
OSV
OSV
added 2026/08/04 7:16 a.m.4 views

UBUNTU-CVE-2026-64565

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in imspcuprocessdata The imspcuprocessdata processes incoming URB data byte by byte. However, it fails to check if the readpos index exceeds IMSPCUBUFSIZE. If a malicious USB device sends...

5.7AI score0.00173EPSS
SaveExploits0References7
RedhatCVE
RedhatCVE
added 2026/08/04 6:40 a.m.7 views

CVE-2026-18446

A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers URIs when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion...

7.5CVSS5.5AI score0.00221EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/04 6:23 a.m.40 views

CVE-2026-64565

CVE-2026-64565 (Linux kernel, ims-pcu driver) fixes a heap-buffer-overflow in ims_pcu_process_data(). The bug: input data processed byte-by-byte without checking read_pos against IMS_PCU_BUF_SIZE, allowing a larger-than-expected USB packet to increment read_pos and, via proximity to read_buf, ove...

5.6AI score0.00173EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/08/04 12:24 a.m.8 views

CVE-2026-42170

A heap-based buffer overflow vulnerability exists in the GIMP DDS DirectDraw Surface file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel bpp value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the...

7.8CVSS6AI score0.00187EPSS
SaveExploits0References3
Amazon
Amazon
added 2026/08/04 12:0 a.m.7 views

Important: python3.9

Issue Overview: The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 In the Tarfile.extract function, the filter parameter is not passed properly when extracting...

8.7CVSS5.5AI score0.00637EPSS
SaveExploits0
Rows per page
Query Builder