CVE-2026-61845

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS...

CVE-2026-61845 Crass: Large numeric exponents cause CPU and memory denial of service

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS...

CVE-2026-61845

The Crass Ruby CSS parser is vulnerable to a Denial of Service (DoS) condition in versions prior to 1.0.7 . The root cause is that the parser converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. An attacker providing a malicious CS...

OpenCLAW-P2P

P2PCLAW - Decentralized Autonomous Research Collective P2PCLAW is a decentralized research network where AI agents and human researchers publish, validate, preserve, and evaluate scientific work through open infrastructure. Latest public paper: arXiv:2604.19792, currently revised as OpenCLAW-P2P...

numpy-1.13.1

Travis CI Status --- NumPy is the fundamental package needed for scientific computing with Python. This package contains: a powerful N-dimensional array object sophisticated broadcasting functions tools for integrating C/C++ and Fortran code useful linear algebra, Fourier transform, and random...

CVE-2026-46350

dcmjs, a JavaScript library for DICOM manipulation used in web-based medical imaging viewers, contains an input validation bypass in its handling of DS Decimal String and IS Integer String value representations. The DecimalString and IntegerString classes in ValueRepresentation.js use a regex...

CVE-2026-61845

Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to "Float::MAX". Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a...

Crass : Large numeric exponents cause CPU and memory denial of service

Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting...

GHSA-6WMF-3R64-VCWV Crass : Large numeric exponents cause CPU and memory denial of service

Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting...

PT-2026-118591

Name of the Vulnerable Software and Affected Versions Crass versions prior to 1.0.7 Description Crass converts CSS scientific notation number values with unbounded exponentiation before clamping the result to Float::MAX. This allows an attacker to provide a small CSS string that forces the...

Astra Linux – Vulnerability in GSL

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing input data that is maliciously crafted for the gslstatsquantilefromsorteddata function of this library may result in unexpected application...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter consumes significant memory when dealing with a string representation of a number in scientific notation with a large exponent...

com.norconex.collectors:norconex-collector-core (3.2.0), com.norconex.collectors:norconex-collector-filesystem (3.2.0) +3 more potentially affected by CVE-2026-66755 via org.apache.tika:tika-parser-scientific-module (>=3.0.0-beta, <=3.3.1)

org.apache.tika:tika-parser-scientific-module MAVEN version =3.0.0-beta, =3.0.0-beta, =3.3.1 Source cves: CVE-2026-66755 Source advisory: SNYK:JAVA-ORGAPACHETIKA-19351260...

org.apache.tika:tika-parser-scientific-package (4.0.0-alpha-1) potentially affected by CVE-2026-66755 via org.apache.tika:tika-parser-scientific-module (4.0.0-alpha-1)

org.apache.tika:tika-parser-scientific-module MAVEN version 4.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tika:tika-parser-scientific-module and may be impacted: - org.apache.tika:tika-parser-scientific-package 4.0.0-alpha-1...

com.norconex.collectors:norconex-collector-core (3.2.0), com.norconex.collectors:norconex-collector-filesystem (3.2.0) +13 more potentially affected by CVE-2026-66755 via org.apache.tika:tika-parser-scientific-module (>=2.1.0, <=3.3.1)

org.apache.tika:tika-parser-scientific-module MAVEN version =2.1.0, =2.8, =2.8, =2.8, =2.8, =2.8, =2.8, =2.8, =2.8, =2.1.0, =3.3.1 Source cves: CVE-2026-66755 Source advisory: MEND:CVE-2026-66755...

org.apache.tika:tika-parser-scientific-package (4.0.0-alpha-1) potentially affected by CVE-2026-66755 via org.apache.tika:tika-parser-scientific-module (4.0.0-alpha-1)

org.apache.tika:tika-parser-scientific-module MAVEN version 4.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tika:tika-parser-scientific-module and may be impacted: - org.apache.tika:tika-parser-scientific-package 4.0.0-alpha-1...

Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing

Large language model LLM agents are starting to take on routine work in high-performance computing HPC, including monitoring Slurm jobs, diagnosing failed builds, inspecting simulation output, and coordinating scientific workflows. To do this work, an agent commonly acts under its user's...

Distributed Denial of Science: How Indirect Data Poisoning of AI Systems Can Industrialize Scientific Fraud

Scientific fraud is the instrument of doubt that malicious entities can use to establish controversy in science. Historically, it required the resources of a company: deep pockets, ghostwritten articles, and corrupt academics. Today, Artificial Intelligence AI is increasingly automating scientifi...

SUSE-SU-2026:21944-1 Security update for vim

This update for vim fixes the following issues - CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim bsc1264706. - CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile via crafted filename bsc1265349. -...

SUSE-SU-2026:21859-1 Security update for vim

This update for vim fixes the following issues - CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes bsc1261833. - CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim...