CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop,...

CVE-2026-119195

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER reject...

CVE-2026-119134

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-8822

A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk versions: 9.6.1. A specially crafted USGS DEM can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-118778

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client...

CVE-2026-115274

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer liter...

CVE-2026-118776

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish, CBC and ECB modes, PKCS7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKC...

CVE-2026-114690

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the...

CVE-2026-107347

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the clien...

CVE-2026-119203

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream positio...

CVE-2026-9536

A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk versions: 9.6.1. A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-115456

A flaw was found in gcc. An attacker could cause a Denial of Service DoS by passing a string that is not null-terminated to the std::fromchars function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or a...

CVE-2026-106972

Uncontrolled recursion in MessagePack\BufferUnpacker::unpack in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input...

CVE-2026-119279

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength and ReadableByteBuf.readIntLengthEncodedNotNull methods narrowed the protocol's unsigned 8-byte length-encoded integer to...

CVE-2026-119140

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing ...

CVE-2026-119286

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

CVE-2026-114691

A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector std::vector constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to...

CVE-2026-119188

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued...

CVE-2026-119130

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can...

CVE-2026-118773

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB, GlobUtil.walkCB2, GlobUtil.walkCBSync, and GlobUtil.walkCB2Sync, invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout rejects or emits...

CVE-2026-119194

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long...

CVE-2026-119209

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries...

CVE-2026-118781

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse, bnModInverse, lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's...

CVE-2026-118766

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make o...

CVE-2026-115455

A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a...

CVE-2026-93008

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who...

CVE-2026-103963

A flaw was found in glib-networking. When establishing connections using Transport Layer Security TLS version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket message...

CVE-2026-42057

An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-119281

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to charactersetclient. It did not reject non-UTF-8 charactersetresults changes an...

CVE-2026-45049

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Cross-Domain Single Sign-On CDSSO servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can...

CVE-2026-119123

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service...

CVE-2026-119131

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a '?' after byte 65535, overflowing a u16 index in the http crate and...

CVE-2026-119206

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The pagelabels property resolves each page independently and repeatedly scans the same /Num...

CVE-2026-119278

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during cachingsha2password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the...

CVE-2026-119139

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...

CVE-2026-8824

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk versions: 9.6.1. A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-119133

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with...

CVE-2026-119124

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the...

CVE-2026-119283

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...

CVE-2026-118777

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name proto so that the...

CVE-2026-119187

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

CVE-2026-119210

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string...

CVE-2026-119141

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the mayleave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, su...

CVE-2026-119189

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a...

CVE-2026-119137

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting th...

CVE-2026-119186

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...

CVE-2026-93006

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the...

CVE-2026-119168

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files,...

CVE-2026-119191

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer, BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING...