CVE-2026-16463 DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD

A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

GHSA-4CWX-7WF7-3272

creationtimestamp| type| source ---|---|--- 2026-07-29 15:21:07+00:00| seen| https://bsky.app/profile/nodeland.dev/post/3mrsa2kt7jx23 2026-08-03 19:25:00+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3ms77zcaiyk2n...

EUVD-2026-50372

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java,...

EUVD-2026-50371

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a...

CVE-2026-54666

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...

EUVD-2026-50370

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

CVE-2026-67215

creationtimestamp| type| source ---|---|--- 2026-07-29 15:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrs6wfpmo72f 2026-07-29 15:40:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsb4uh6gh2q 2026-08-05 18:07:07+00:00| seen|...

io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)

A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security...

ROOT-APP-MAVEN-CVE-2026-22751 CVE-2026-22751 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2026-22751 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

Summary swagger-typescript-api interpolates OpenAPI path strings the keys of the paths object, e.g. /users/id directly into a JavaScript template literal inside the body of every generated API method, without escaping. A spec path containing $ … survives parseRouteName's x / :x rewriter verbatim...

CVE-2026-65889

creationtimestamp| type| source ---|---|--- 2026-07-29 14:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrs5ghjoz22s 2026-07-29 14:53:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrs6j74a6u2i 2026-08-06 08:07:06+00:00| seen|...

CVE-2026-9177

creationtimestamp| type| source ---|---|--- 2026-07-29 14:32:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrs5cvb4ox2y 2026-07-29 15:03:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrs73bdmgs2i...

CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

CVE-2026-65617

creationtimestamp| type| source ---|---|--- 2026-07-29 14:00:04+00:00| seen| https://t.me/truesecator/8453 2026-07-29 18:26:43+00:00| seen| https://gist.github.com/KenjiChao/6ccd539d859069efbde44630121c5669 2026-07-30 00:00:29+00:00| seen| https://t.me/truesecator/8453 2026-07-31 07:07:07+00:00|...

EUVD-2026-50335

Joomla Extension - balbooa.com - Payment bypass in Gridbox 2.20.2...

CVE-2026-18174 @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-18174

The CVE-2026-18174 entry concerns @fastify/forwarded. In versions before 3.0.2, the X-Forwarded-For parser trims only spaces when entries are comma-separated and does not strip horizontal tabs. As a result, an entry padded with a tab retains a literal tab in the resolved client IP string, potenti...

CVE-2026-67216

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2016-3239

creationtimestamp| type| source ---|---|--- 2026-07-29 13:01:14+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-07-30 00:01:50+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-08-01 11:00:12+00:00| seen|...

CVE-2026-41709

creationtimestamp| type| source ---|---|--- 2026-07-29 13:00:55+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0269 2026-07-29 16:45:15+00:00| seen| https://www.ncsc.nl/alerts/kritieke-kwetsbaarheden-in-vmware-vcenter-en-esx-producten-update-onmiddellijk 2026-07-29 17:00:04+00:00|...