A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or ...

CVE-2026-95512

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerabilit

历史摘要 · 未重新核验 · NVD

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow serve...

CVE-2026-91828

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authenticati

历史摘要 · 未重新核验 · NVD

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that...

CVE-2026-103760

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated rem

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the f

历史摘要 · 未重新核验 · GitHub Advisory

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never read...

CVE-2026-103760

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated rem

历史摘要 · 未重新核验 · NVD

Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write

CVE-2026-103760

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated rem

历史摘要 · 未重新核验 · OSV.dev

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same conne...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the f

历史摘要 · 未重新核验 · NVD

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when d

历史摘要 · 未重新核验 · GitHub Advisory

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength ...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when d

历史摘要 · 未重新核验 · NVD

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength l...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when de

历史摘要 · 未重新核验 · NVD

jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

CVE-2026-68495 · CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when d

历史摘要 · 未重新核验 · OSV.dev

jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

CVE-2026-68496 · CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when de

历史摘要 · 未重新核验 · OSV.dev

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

CVE-2026-89425

## Status **FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a 20,000,109-character

历史摘要 · 未重新核验 · GitHub Advisory

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

CVE-2026-89407

## Status **FULLY REPRODUCED** with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for

历史摘要 · 未重新核验 · GitHub Advisory

devalue: Residual sparse-array CPU amplification in uneval

`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker

历史摘要 · 未重新核验 · GitHub Advisory

devalue: Repeated primitive strings cause quadratic expansion in uneval

Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into

历史摘要 · 未重新核验 · GitHub Advisory

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Evaluating legitimate `uneval` output for a sparse array can allocate memory proportional to its declared length. A tiny

历史摘要 · 未重新核验 · GitHub Advisory

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_d...

CVE-2026-102999

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files c

历史摘要 · 未重新核验 · NVD

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode m...

CVE-2026-102995

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source

历史摘要 · 未重新核验 · NVD

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side ...

CVE-2026-102144

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to

历史摘要 · 未重新核验 · NVD