📄 TinyWeb 0.0.8 NULL Pointer / Denial of Service

TinyWeb versions 0.0.8 and earlier contain a NULL pointer dereference vulnerability in the HTTP request parsing and response handling logic. An unauthenticated remote attacker can send a malformed HTTP request that causes the server to dereference a NULL Url pointer, crashing worker processes and...

Oracle Linux 8 : dovecot (ELSA-2026-46532)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-46532 advisory. 1:2.3.16-8 - fix CVE-2026-42006: fix IMAP parser listcountlimit to correctly limit open braces instead of close braces RHEL-188480 Tenable has extracted the...

WatchGuard FireWare OS cli Token Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of CLI commands. The issue results from the lack of proper validation of...

(Pwn2Own) Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exis...

📄 TinyWeb 0.0.8 Denial of Service

TinyWeb versions 0.0.8 and earlier contain a missing memory deallocation vulnerability that results in unbounded memory consumption. An unauthenticated remote attacker can repeatedly send ordinary HTTP requests to trigger a per-request memory leak, eventually exhausting worker memory and causing ...

CVE-2026-55389

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in...

CVE-2026-54655

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-55390

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

CVE-2026-55390 Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

Malicious Package

Overview text-line-parser is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in text-line-parser (npm)

Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs hexToRgb/rgbToHsl. On npm install, postinstall.js executes a shell pipeli...

CVE-2026-67184

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-51274

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-67184

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

EUVD-2026-49900

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion

A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gstav1parserparsetilelistobu function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a special...

gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion

A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gstav1parserparsetilelistobu function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a special...

Malicious code in local-config-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa2dd509a9d17ced72d7119cf68768f7356d3f67af131e9cbe5bfe981a626ac4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in local-config-parser

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview local-config-parser is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...