CVE-2026-55862 pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and...

CVE-2026-55862 pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and...

CVE-2026-55862 pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and...

CVE-2026-55862

The pupnp SDK, used for developing UPnP device and control point applications, is vulnerable to a stack overflow in versions prior to 2.0.0 . The vulnerability arises because several ixml DOM traversal functions —specifically ixmlPrintDomTreeRecursive, ixmlNode_getElementsByTagNameRecursive, ixml...

Stack overflow when parsing deeply nested input in pest_grammars

Impact In affected versions, parsing deeply nested input with pestgrammars::json::JsonParser can exhaust the native stack and abort the hosting process. Applications that accept attacker-controlled JSON without suitable resource limits may therefore be vulnerable to denial of service. The reporte...

Ivanti Connect Secure - Stack-based Buffer Overflow

Ivanti Connect Secure 22.7R2.5, Ivanti Policy Secure 22.7R1.2, and Ivanti Neurons for ZTA gateways 22.7R2.3 contain a stack-based buffer overflow in the clientCapabilities parameter handling. This vulnerability allows remote unauthenticated attackers to execute arbitrary code through IF-T TLS...

CVE-2026-111711: Stack-based Buffer Overflow

Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's userok function, which copies Basic-auth usernames with unbounded strcpy calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to an...

CVE-2026-100354

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

PT-2026-116110

Name of the Vulnerable Software and Affected Versions Netcore NR256CN versions 1.0 through 1.5.140116 Description A pre-authentication stack overflow exists in the Boa web server. The issue occurs within the user ok function, which uses unbounded strcpy calls to copy Basic-auth usernames into...

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

Summary kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader resolves circular $refs on purpose to support recursive data structures, and Schema.validate uses stack-based cycle detection. Validate therefore accepts a schema whose allOf / anyO...

GHSA-G8CF-RCJF-C8CF kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

Summary kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader resolves circular $refs on purpose to support recursive data structures, and Schema.validate uses stack-based cycle detection. Validate therefore accepts a schema whose allOf / anyO...

CVE-2025-34096

🐞 CVE-2025-34096: Easy File Sharing Web Server 7.2 - Stack-Based Buffer Overflow SEH SEH-based buffer overflow in Easy File Sharing Web Server 7.2, reachable through the password recovery endpoint. 📑 Table of Contents Why this repository exists Why this vulnerability is interesting Context and...

CVE-2026-52167

A stack overflow in the gensubParsePsb function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service DoS via supplying a crafted .PSB subtitle file...

CVE-2026-100354 kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

CVE-2026-100354

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

CVE-2026-100354 kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

EUVD-2026-102162

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

Astra Linux – Vulnerability in opensc

Buffer overflow issues were identified in Opensc before version 0.22.0 in various locations, which could potentially cause programs using the library to crash...

Astra Linux – Vulnerability in connman

ConnMan also known as Connection Manager versions 1.30 to 1.39 have a stack-based buffer overflow issue in the uncompress function of dnsproxy.c, occurring due to the use of NAME, RDATA, or RDLENGTH fields for the A or AAAA records...

Astra Linux – Vulnerability in Cairo

A flaw was discovered in cairo’s image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo’s image-compositor for example, by convincing a user to open a file in an application that uses cairo, or if an application uses cairo on...