CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

CVE-2026-116872

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalizecompactform that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:... or has:... expressions to...

CVE-2026-116872 Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalizecompactform that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:... or has:... expressions to...

CVE-2026-116872 Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalizecompactform that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:... or has:... expressions to...

CVE-2026-116872

Semantic MediaWiki versions 3.0.0 before 7.3.1 are vulnerable to an algorithmic complexity vulnerability located in the TermParser::normalize_compact_form() function. When the extended search engine is enabled, unauthenticated attackers can submit long search terms containing numerous distinct in...

EUVD-2026-110700

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalizecompactform that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:... or has:... expressions to...

PT-2026-126333

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize compact form that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:... or has:... expressions to...

EUVD-2026-107412

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving Odepth^2 CPU denial of service...

CVE-2026-114129

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114129

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

PT-2026-120732

Name of the Vulnerable Software and Affected Versions stream-json versions 2.0.0 through 3.6.9 Description FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Due to unbounded object or array nesting, a document...

OESA-2026-4320 python-sqlparse security update

A non-validating SQL parser. Security Fixes: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l...

Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Incrementally arriving form...

GHSA-57XR-HFXX-JW5X Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Incrementally arriving form...

CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

UBUNTU-CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

DEBIAN-CVE-2026-107678

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...

CVE-2026-107678 FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...