CVE-2026-15830

An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

RLSA-2026:49667 Moderate: p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS11 modules. The p11-kit-trust subpackage includes a PKCS11 trust module that provides certificate anchors and black lists based on configuration files. Security Fixes: p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing...

p11-kit security update

An update is available for p11-kit. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The p11-kit packages provide a mechanism to manage PKCS11 modules. The...

Critical: php8.5

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Attacker-provided inputs to bccomp could lea...

Critical: php8.4

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Attacker-provided inputs to bccomp could lea...

Critical: php8.2

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Circular symbolic links in phar archives cou...

CVE-2026-15830: Uncontrolled Recursion

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-2041)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2041 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...

SUSE SLED15 / SLES15 Security Update : perl-Net-DNS (SUSE-SU-2026:3456-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3456-1 advisory. This update for perl-Net-DNS fixes the following issue - CVE-2026-64194: RFC 1035 compression pointers are followed via...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-2044)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2044 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-2043)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2043 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...

Amazon Linux 2 : php, --advisory ALAS2PHP8.2-2026-013 (ALASPHP8.2-2026-013)

The version of php installed on the remote host is prior to 8.2.33-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2026-013 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions...

DEBIAN-CVE-2026-69249

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...

CVE-2026-46714 Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-46714 Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-46714

Misskey web client (versions 8.63.0 and later prior to 2026.5.4) is vulnerable to a DoS caused by a malformed theme triggering uncontrolled recursion during theme compilation, which can slow or crash the client. The issue is fixed in version 2026.5.4. Remediation is to upgrade to 2026.5.4 or late...

CVE-2026-46714 Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-67312

A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data...

No title provided

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a...

CVE-2026-67313

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a...