CVE-2026-93687

CVE-2026-93687 affects the braces library (micromatch) through version 3.0.3 . The vulnerability resides in the recursive AST walkers (in compile.js, parse.js, and expand.js) that lack depth guards. An attacker can supply deeply nested brace patterns under the character limit to exhaust the call ...

CVE-2026-93687 braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError...

Vulnerability concealment in Check Point’s Security Management and Log Servers

Check Point has identified a vulnerability in its Security Management and Log Servers. This vulnerability involves a stack overflow that occurs during the unauthorized login process. An attacker can exploit this vulnerability to execute arbitrary code with root privileges. As a result, the attack...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the ordered-JSON marshal/unmarshal paths through the jsonutils/adapters/stdlib/json and jsonutils/adapters/easyjson/json ordered map handlers. An attacker can crash the process by sending a deeply nested JSON...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the ordered-JSON marshal/unmarshal paths through the jsonutils/adapters/stdlib/json and jsonutils/adapters/easyjson/json ordered map handlers. An attacker can crash the process by sending a deeply nested JSON...

EUVD-2026-82602

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

CVE-2026-93450

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

AZL-103377 CVE-2026-93450 affecting package kubevirt 1.8.4-2

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

PT-2026-99971

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError...

EulerOS 2.0 SP10 : python3 (EulerOS-SA-2026-3766)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Use-after-free UAF was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a...

EulerOS Virtualization 2.12.0 : python3 (EulerOS-SA-2026-3663)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XM...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109797)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109797 advisory. When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occur...

EulerOS 2.0 SP10 : python3 (EulerOS-SA-2026-3719)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Use-after-free UAF was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a...

EulerOS Virtualization 2.12.1 : python3 (EulerOS-SA-2026-3609)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XM...

CVE-2026-93687: Uncontrolled Recursion

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError...

CVE-2026-93450: Uncontrolled Recursion

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

PT-2026-95431

Name of the Vulnerable Software and Affected Versions braces versions prior to 3.0.4 Description A stack overflow occurs in the recursive AST Abstract Syntax Tree walkers due to a lack of depth guards. An attacker can provide deeply nested brace patterns that remain within the character limit to...

Linux Distros Unpatched Vulnerability : CVE-2026-93119

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: ljca: bound banknum in ljcaenumerategpio ljcaenumerategpio reads desc-banknum from the device and loops validpini = getunalignedle32... for i banknum...

EulerOS Virtualization 2.12.1 : libxml2 (EulerOS-SA-2026-3596)

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a...

EulerOS Virtualization 2.11.0 : grub2 (EulerOS-SA-2026-3507)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing...