CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

msgpack5: Quadratic parsing in the streaming decoder

Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop. Patches The decoder now preserves incremental...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-of-Service via React Flight Protocol Quadratic CPU Exhaustion in Server Components Map Deserialization Overview • How It Works • Tools • Install • Usage • Nuclei • Fix • Disclaimer Vulnerability Overview Field| Detail ---|--- CVE ID|...

AZL-106842 CVE-2026-107297 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

EUVD-2026-95108

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297

The msgpack5 library (a msgpack v5 implementation for Node.js and the browser) is vulnerable to a quadratic CPU use issue in versions prior to 6.1.0 . The streaming decoder reparses incomplete arrays or maps from the beginning every time a new chunk arrives. A remote peer can exploit this by spli...

CVE-2026-107678 FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...

EUVD-2026-95083

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...

CVE-2026-107678

Versions of FFmpeg through 9.0.2 are vulnerable to a stack exhaustion vulnerability in the av_encryption_init_info_free() function located in libavutil/encryption_info.c. The issue stems from the recursive freeing of AVEncryptionInitInfo linked lists created by the MOV demuxer's mov_read_pssh() f...

CVE-2026-107678 FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...

PT-2026-108125

Name of the Vulnerable Software and Affected Versions CairoSVG versions prior to 2.9.1 Description Rendering an attacker-controlled SVG containing a path with many segments can lead to quadratic CPU consumption. This occurs due to two issues in cairosvg/path.py: the path tokenizer repeatedly slic...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses transformers-5.8.0-py3-none-any.whl, mlflow-3.11.1-py3-none-any.whl, sqlparse-0.5.4-py3-none-any.whl, nltk-3.10.0-py3-none-any.whl, gitpython-3.1.53-py3-none-any.whl, and cryptography-46.0.7-cp311-abi3-macosx109universal2.whl which are vulnerable to CVE-2026-80047,...

EUVD-2026-91056

stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk...

CVE-2026-84305

A flaw was found in sqlparse, a non-validating SQL parser module for Python. A remote attacker could exploit this by providing specially crafted parenthesized tuple lists. When these lists are reindentated, the software performs numerous offset calculations, leading to quadratic CPU consumption...