CLEANSTART-2026-NC17726 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-GL35722 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-AH49048 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-ZC15270 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it

Security vulnerability affects the npm package. PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it...

PT-2026-108150

Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.16.0 Description The APEv2 parser in music-metadata contains an issue where it reads a tag-item size controlled by an attacker and allocates a Uint8Array for a binary item before verifying if the declared si...

PT-2026-108645

Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...

PT-2026-108124

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.59.0 through 0.80.0 Description An issue exists where an attacker-controlled Protobuf schema can provide absolute or parent-directory paths. These paths are captured by WEAK IMPORT PATTERN and processed by t...

PT-2026-108174

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.0 through 12.2 Description A heap-based buffer overflow exists in the MongoDB protocol parser. A remote attacker can trigger memory corruption by sending a specially crafted MongoDB SCRAM username with ...

PT-2026-108173

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.0 through 12.2 Description A heap-based out-of-bounds read exists in the TDS7 LOGIN7 protocol parser. A remote attacker can exploit this by sending a specially crafted TDS LOGIN7 packet that contains...

PT-2026-108170

Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.16.0 Description The MP4 parser accepts an attacker-controlled 64-bit extended atom size and converts it to a JavaScript Number. This resulting payload length is used for atom-specific readToken calls before...

PT-2026-108171

Name of the Vulnerable Software and Affected Versions music-metadata versions 11.14.1 through 11.15.x Description A regression in the MP4 stsd sample-description parser allows a crafted MP4-family input to cause a denial of service. By providing a sample-entry size of zero and a specific entry...

EulerOS 2.0 SP15 : perl-HTML-Parser (EulerOS-SA-2026-4003)

According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities.x000D x000D The XS routine backing...

PT-2026-108151

Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.16.0 Description The ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before verifying if the input contains the declared bytes. A specially crafted file such as MP3, FLAC,...

SUSE SLES16: libwireshark18 / libwiretap15 / libwsutil16 / wireshark / etc (SUSE-SU-2026:24013-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24013-1 advisory. Update to Wireshark 4.4.18: - CVE-2026-19694: TTX Logger file parser crash bsc1275279. - CVE-2026-19695: Gammu DCT3 trace file...

PT-2026-107940

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description A...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Libwebsockets vulnerabilities (USN-8893-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8893-1 advisory. It was discovered that libwebsockets did not properly validate user-supplied data when parsing HTTP/2...

Security Bulletin:qs.stringify TypeError: obj.constructor.isBuffer is not a function when serializing objects with own constructor.isBuffer property

Summary Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as...

Security Bulletin:body-parser Limit Validation Vulnerability in Versions Prior to 1.20.6 and 2.3.0

Summary Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit...

Security Bulletin:Bouncy Castle Java OER Parser Recursion Issue on IEEE 1609.2 Schema

Summary In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

EUVD-2026-94396

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version...