DEBIAN-CVE-2026-59880

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such a...

ROS-20260708-73-0050

The vulnerability of the jq JSON processing tool lies in the use of a hash function that does not meet security requirements. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or cause service failures...

PT-2026-56508

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description A flaw in the Python Markdown parser occurs when the strikethrough, mark, or insert plugins scan for matching markers from each possible start position. Specifically, a sequence of closed tilde,...

The vulnerability of the MSL format processor in the ImageMagick console graphics editor allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the MSL format processor in the ImageMagick console-based graphics editor is related to uncontrolled recursion. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service interruptions...

The vulnerability of ImageMagick’s PSD format file processor allows attackers to compromise the confidentiality of protected information.

The vulnerability of ImageMagick’s PSD format file processor relates to reading data beyond the permitted range of memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality of the protected information...

PT-2026-56499

Name of the Vulnerable Software and Affected Versions Immutable.js versions prior to 4.3.9 Immutable.js versions prior to 5.1.8 Description Immutable.Map and Immutable.Set store keys with identical 32-bit hashes in a HashCollisionNode collision bucket that is scanned linearly. An attacker capable...

The vulnerability of the drivers/gpu/drm/panthor components of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the drivers/gpu/drm/ptorh components of the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-56519

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description A Python Markdown parser with renderers and plugins contains an issue where a Markdown document with numerous repeated or distinct reference-link definitions triggers quadratic work within...

PT-2026-56400

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.4.1 Description Improper input validation in the Stripe Connect payment processor allows unauthenticated attackers to pay an arbitrary amount. This occurs...

PYSEC-2026-1605 Marshmallow has DoS in Schema.load(many)

Impact Schema.loaddata, many=True is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. Patches 4.1.2, 3.26.2 Workarounds py Fail fast def loadmanyschema, data, kwargs: if not isinstancedata, list: raise ValidationError'Invalid...

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)

ImpactIn affected versions, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service.This can be done if the DSN is known, which it is in many common setups JavaScript, Mobile Apps. PatchesPatched in Bugsink 2.0.6...

PYSEC-2026-2019 vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

Summary Users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape e.g. hidden dimension is wrong, regardless of whether the model is intended to support such inputs as defined in the Supported Models page. The issue has...

PYSEC-2026-1977 Transformers is vulnerable to ReDoS attack through its DonutProcessor class

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json method. This vulnerability affects versions 4.51.3 and earlier, and is fixed in version 4.52.1. The issue arises from the...

PYSEC-2026-1359 fastapi-guard is vulnerable to ReDoS through inefficient regex

Summary fastapi-guard detects penetration attempts by using regex patterns to scan incoming requests. However, some of the regex patterns used in detection are extremely inefficient and can cause polynomial complexity backtracks when handling specially crafted inputs. It is not as severe as...

PYSEC-2026-1835 pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if parsecontentstream is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the...

PYSEC-2026-1837 PyPDF2 quadratic runtime with malformed PDF missing xref marker

Impact An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. Patches https://github.com/py-pdf/pypdf/pull/808 Workarounds ...

SUSE CVE-2026-13875

Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

Cisco IOS XE Software for ASR 903 Aggregation Services Routers ARP DoS (cisco-sa-asr903-rsp3-arp-dos-WmfzdvJZ)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 RSP3C could allow an unauthenticated,...

Important: docker

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

The vulnerability of the functions get_perf_level_count() and cppc_get_cpu_power() in the driver/cpufreq/cppc_cpufreq.c module, a frequency scaling driver for Linux processors, allows a hacker to trigger a service failure.

The vulnerability of the getperflevelcount and cppcgetcpupower functions in the drivers/cpufreq/cppccpufreq.c driver for scaling kernel frequency in Linux operating systems is related to copying buffers without checking their size a classic buffer overflow attack. Exploiting this vulnerability...