A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of s...

CVE-2026-103963

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the

来源摘录 · NVD / GitHub Advisory

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document excee...

CVE-2026-119286

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a

来源摘录 · NVD / GitHub Advisory / OSV.dev

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization c...

CVE-2026-119284

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

来源摘录 · NVD

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a ...

CVE-2026-119283

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

来源摘录 · NVD

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that ...

CVE-2026-119209

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while openi

来源摘录 · NVD / GitHub Advisory / OSV.dev

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted en...

CVE-2026-119208

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory wh

来源摘录 · NVD / GitHub Advisory

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested pars...

CVE-2026-119207

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict

来源摘录 · NVD / GitHub Advisory

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label n...

CVE-2026-119206

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page

来源摘录 · NVD / GitHub Advisory

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resourc...

CVE-2026-119204

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsi

来源摘录 · NVD / GitHub Advisory

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING ...

CVE-2026-119191

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / OSV.dev

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, m...

CVE-2026-118779

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(...

CVE-2026-118773

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including Gl

来源摘录 · NVD / GitHub Advisory / OSV.dev

Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

## Summary An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthent

来源摘录 · GitHub Advisory

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

CVE-2026-115907

### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and

来源摘录 · GitHub Advisory

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

CVE-2026-115909

### Summary The symbolic-link branch of `ZipArchive::extract_internal()` allocates a buffer using an attacker-declared

来源摘录 · GitHub Advisory

Crass: Non-ASCII characters cause superlinear CPU consumption

CVE-2026-61848

### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of m

来源摘录 · GitHub Advisory

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

CVE-2026-61846

### Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value

来源摘录 · GitHub Advisory

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

CVE-2026-62160

### Summary Daptin's `LanguageMiddleware` (registered as a global gin middleware) calls `golang.org/x/text/language.Par

来源摘录 · GitHub Advisory

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead ...

CVE-2026-90870

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versi

来源摘录 · NVD

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open ...

CVE-2026-93007

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive t

来源摘录 · NVD