glasgo

Glasgo Static Analysis Tool This project's official repository has been moved to Github-ttarvis/glasgo. Project This is a static analysis tool written in Go for Go code. It will find security and some correctness issues that may have a security implication. Compiling To compile the tool, be sure ...

CVE-2024-21626-PoC

CVE-2024-21626 Root cause & Proof of Concept How to use poc-autoplay? make install make uninstall 1. Root cause In runc versions ≤ 1.1.11, when opening the host's /sys/fs/cgroup directory to set cgroups, the file descriptor is left open for the container initialization process without closing it,...

CVE-2026-106575

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...

CVE-2026-106575 ImageMagick: Unclosed file pointer in magick script

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...

Astra Linux – Vulnerability in libxpm

A flaw was discovered in libXpm. This issue occurs when parsing a file with a comment that is not closed properly; the “end-of-file” condition will not be detected, leading to an infinite loop and causing a Denial of Service in the application that uses the library...

GHSA-58MR-GQGX-XQ4G fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

Impact fast-uri accepts a host that contains an unbalanced or misplaced authority bracket or without reporting an error. A host that starts with but does not end with , such as @127.0.0.1, is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the host wi...

NPM: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

NPM: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.5...

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

Impact fast-uri accepts a host that contains an unbalanced or misplaced authority bracket or without reporting an error. A host that starts with but does not end with , such as @127.0.0.1, is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the host wi...

LiquidJS has an infinite loop vulnerability in its `strip_html` filter

Summary The current implementation of striphtml can cause an infinite loop when the input string contains appears after ' as the catch-all kind; a regex // equivalent is On^2 in V8 on unclosed openers. export function striphtml this: FilterImpl, v: string const str = stringifyv...

CVE-2026-84394

fast-uri (a URI parsing library used by the Fastify ecosystem) contains a host confusion vulnerability: when a URI's authority contains an opening bracket [ without a matching closing bracket ], parse() returns the string as the host without error. Neither an IP literal nor a valid domain name is...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

SUSE CVE-2026-75003

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation...

CVE-2026-75003

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation...

Regular Expression Denial of Service (ReDoS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the SKILLMENTIONRE and stripre regex patterns in the middleware process. An attacker can cause the application to become unresponsive for all users by sending...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop in ContentStream.readinlineimage in pypdf/generic/datastructures.py. An attacker can hang text extraction or any oth...

CVE-2026-4375: Undefined Security Weakness

The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine in the RenderIssueIndexPattern process. An attacker can cause a panic and disrupt service availability by configuring a specially crafted issue index pattern containi...

CVE-2026-52796

CVE-2026-52796 / GHSA-4J89-2C4F-44C6 : Gogs before 0.14.3 is vulnerable to a DoS caused by a rendering panic in the issue index pattern. The bug arises when rendering the index link in internal/markup/markup.go: com.Expand is fed a pattern containing an opening brace “{” but no matching “}”, lead...