Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

CVE-2026-95276

An improper input validation flaw was found in the Themes component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517730821...

PYSEC-2026-4024 AnyIO process-pool workers can block indefinitely on undrained stderr

Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code...

AnyIO process-pool workers can block indefinitely on undrained stderr

ImpactAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code th...

CVE-2026-13043 WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access

A missing authentication vulnerability in the Kernel Memory Access Driver PSKMAD used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of...

GHSA-JXXV-8R27-VM4P vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

Summary The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions then destructures the array to undefined...

vm2 crypto builtin loads attacker native code through setEngine

Summary vm2 3.11.6 exposes the host crypto module to a NodeVM when that single builtin is allowed. The module is presented through a read-only bridge, but its functions still execute with host-process authority. crypto.setEngine accepts a filesystem path and asks OpenSSL to dynamically load the...

GHSA-46PR-C5WC-XFFX vm2 crypto builtin loads attacker native code through setEngine

Summary vm2 3.11.6 exposes the host crypto module to a NodeVM when that single builtin is allowed. The module is presented through a read-only bridge, but its functions still execute with host-process authority. crypto.setEngine accepts a filesystem path and asks OpenSSL to dynamically load the...

NPM: vm2 NodeVM can replace the host process TLS trust store

NPM: vm2 NodeVM can replace the host process TLS trust store vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

EUVD-2026-83362

devalue: stringify/uneval serialize shared memory...

GHSA-X5RW-Q4PP-HG5G devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applicatio...

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applicatio...

Allocation of Resources Without Limits or Throttling

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the appearance stream rendering loop in appearancestream.py, where...

Allocation of Resources Without Limits or Throttling

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via collectttt1characterwidths in pypdf/font.py, where a PDF containing a...

CVE-2026-102504

Imager versions before 1.037 for Perl are vulnerable to a Denial of Service (DoS) condition in the i_readraw_wiol function. The software fails to perform range checks on the raw_datachannels value, allowing a negative or excessively large count to trigger an excessive memory allocation . When thi...

CVE-2026-102504 Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range rawdatachannels value in ireadrawwiol. Nothing range-checks rawdatachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large coun...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.1

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.1 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

BIT-PHP-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and c...