jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
CVE-2026-89407
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expres
#cwe-400
共收录 1360 条相关情报。
← 返回所有主题A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs wh...
CVE-2026-94449
A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries an
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompress...
CVE-2026-63452
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-...
CVE-2026-63448
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/...
CVE-2026-57227
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dh...
CVE-2026-57224
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS ...
CVE-2026-69186
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NS
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/co...
CVE-2026-33625
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 conta
c-ares: Memory-amplification denial of service via unvalidated DNS header record counts
CVE-2026-69186
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NS
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
CVE-2026-33625
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 conta
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
CVE-2026-33625
### Summary lmdeploy <= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that al
Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or...
CVE-2026-68914
Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not li
Mojolicious pure-Perl Mojo::JSON decoder allows memory exhaustion via deeply nested data
CVE-2026-68914
Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not li
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers c...
CVE-2026-93590
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy chec
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option i...
CVE-2026-93587
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CU
ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder
CVE-2026-93590
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy chec
ImageMagick before 7.1.2-31 Policy Bypass via PCD decoder
CVE-2026-93587
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CU
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing ...
CVE-2026-88798
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using
A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of...
CVE-2026-93310
A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collect
A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Re...
CVE-2026-93310
A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collect