ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur a...

CVE-2026-116141

ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade im

来源摘录 · NVD

postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

### Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=

历史摘要 · 未重新核验 · GitHub Advisory

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes receiv...

CVE-2026-115776

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.word

来源摘录 · NVD

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an una...

CVE-2026-115775

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.

来源摘录 · NVD

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNested...

CVE-2026-115774

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail

来源摘录 · NVD

vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

CVE-2026-114055

## Summary API clients can supply arbitrary `mm_processor_kwargs` per request. vLLM forwards these values through the m

历史摘要 · 未重新核验 · GitHub Advisory

pypdf: Possible long runtimes for repeated references to the same missing object

CVE-2026-115572

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading

历史摘要 · 未重新核验 · GitHub Advisory

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

CVE-2026-115585

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-re

历史摘要 · 未重新核验 · GitHub Advisory

Echo: Decompress permits unbounded gzip expansion in v4

## Impact Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded si

历史摘要 · 未重新核验 · GitHub Advisory

Echo: BodyDump captures request and response bodies without size limits in v4

## Impact Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

CVE-2026-115774

## Summary An infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

CVE-2026-115776

## Summary An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

CVE-2026-115778

## Summary An allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthen

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

CVE-2026-115775

## Summary An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote

历史摘要 · 未重新核验 · GitHub Advisory

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could s...

CVE-2026-115585

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malform

来源摘录 · NVD

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing re...

CVE-2026-115572

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly re

来源摘录 · NVD

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum...

CVE-2026-86019

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows

来源摘录 · NVD

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum att...

CVE-2026-86018

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows

来源摘录 · NVD

wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP...

CVE-2026-115388

wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:

来源摘录 · NVD

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose defaul...

CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG re

来源摘录 · NVD