CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

DEBIAN-CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

AZL-98544 CVE-2026-82397 affecting package python-tornado 6.3.3-11

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

CVE-2026-82398

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

UBUNTU-CVE-2026-82398

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

UBUNTU-CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

Kirby: File upload permissions are not checked during processing of chunk data

TL;DR This vulnerability affects all Kirby sites where users of a particular role have access to the REST API access.panel permission is enabled but no permission to upload any kind of file files.create, files.replace and user/users.update permissions are all disabled. It was possible to fill up...

EUVD-2026-40267

decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input...

GHSA-VCC3-GHJQ-M6FR decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

Impact An attacker who can supply input to decodeUriComponent directly or via a dependency that uses this package on URL/query/path data can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote...

Vehicle-Service-Management-System-User-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46073 Titre de l'exploit: Vehicle Service Management System - Cross Site Scripting XSS stocké dans la 'Liste des utilisateurs' Auteur de l'exploit: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIUM Références:...

Vehicle-Service-Management-System-Settings-Stored-Cross-Site-Scripting-XSS

CVE-2021-46074 Titre de l'exploit: Vehicle Service Management System - 'Settings' Stored Cross Site Scripting XSS Auteur de l'exploit: SANU P.L CVE: CVE-2021-46074 CVSS : 4.8 MOYEN Références : https://www.plsanu.com/vehicle-service-management-system-settings-stored-cross-site-scripting-xss...

CVE-2025-54939

PoC pour QUIC-LEAK CVE-2025-54939 dans LSQUIC Aperçu Ce PoC met en évidence CVE-2025-54939, une vulnérabilité d'épuisement de mémoire avant l'établissement de la liaison déni de service dans l'implémentation QUIC de LSQUIC. Ce problème, nommé QUIC-LEAK, a été documenté pour la première fois par...

Vehicle-Service-Management-System-Service-Requests-Stored-Cross-Site-Scripting-XSS

CVE-2021-46070 Titre de l'exploit : Vehicle Service Management System - 'Service Requests' Stored Cross Site Scripting XSS Auteur de l'exploit : SANU P.L CVE : CVE-2021-46070 CVSS : 4.8 MEDIUM Références :...

Vehicle-Service-Management-System-MyAccount-Stored-Cross-Site-Scripting-XSS

CVE-2021-46068 Titre de l'exploit: Vehicle Service Management System - 'MyAccount' Cross-Site Scripting stocké XSS Auteur de l'exploit: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 MOYEN Références: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss...

CVE-2026-82398

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82398 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82398

pypdf , a pure-Python PDF library, is vulnerable to excessive resource consumption in the read_until_whitespace function within pypdf/_utils.py. When processing a crafted PDF containing a long sequence of non-whitespace bytes, the function performs immutable bytes concatenation in a one-byte loop...

CVE-2026-82398 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...