A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Par...

CVE-2026-120217

A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file lo

来源摘录 · NVD

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqe...

CVE-2026-63341

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or

来源摘录 · NVD

pypdf has possible large memory usage when parsing page tree

CVE-2026-119204

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires par

来源摘录 · GitHub Advisory

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

CVE-2026-118773

### Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directori

来源摘录 · GitHub Advisory

pypdf has possible long runtimes when retrieving page labels

CVE-2026-119206

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retriev

来源摘录 · GitHub Advisory

pypdf has possible large memory usage for exceptions in strict mode

CVE-2026-119207

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loa

来源摘录 · GitHub Advisory

pypdf has possible long runtimes/large memory usage for encrypted PDF files

CVE-2026-119208

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This req

来源摘录 · GitHub Advisory

pypdf has possible large memory usage when parsing cross-reference streams

CVE-2026-119209

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires ope

来源摘录 · GitHub Advisory

Forge: Regular expression denial of service in PEM decoding (pem.decode)

CVE-2026-118779

### Summary `pem.decode()`, which every node-forge API that parses PEM input uses, split messages with a regular express

来源摘录 · GitHub Advisory

russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

CVE-2026-116774

## Summary A peer can advertise `maximum packet size = 0` in its channel-open message (`CHANNEL_OPEN` when attacking a

来源摘录 · GitHub Advisory

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field

### Summary Unbounded and unvalidated memory allocation in imgproxy's ICO loader (`vips/icoload.c`). An attacker-contro

来源摘录 · GitHub Advisory

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, `POST /pins` in `src/fil...

CVE-2026-62300

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up

来源摘录 · NVD

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `...

CVE-2026-62254

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger a

来源摘录 · NVD

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating ...

CVE-2026-62250

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_pre

来源摘录 · NVD

Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()...

CVE-2026-62303

Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResourc

来源摘录 · NVD

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddle...

CVE-2026-62160

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` pas

来源摘录 · NVD / OSV.dev

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and n...

CVE-2026-61854

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report

来源摘录 · NVD / OSV.dev

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficie...

CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass

来源摘录 · NVD

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authenti...

CVE-2026-59396

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a

来源摘录 · NVD

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service t...

CVE-2026-109821

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an a

来源摘录 · NVD / OSV.dev