CVEs

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js,…

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses…

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This…

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This…

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename (prog_file) directly into the Programs.File database field and later uses this value as the…

jbig2dec: jbig2dec: Denial of Service via crafted input

wireshark: Wireshark: Information disclosure in BLF file parser

Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

etcd: etcd: Authentication bypass due to improper Certificate Revocation List enforcement on gRPC listener

Wireshark: Wireshark: Denial of Service via IEEE 802.11 protocol dissector crash

wireshark: Wireshark: Denial of Service via Catapult DCT2000 protocol dissector crash

wireshark: Wireshark: Denial of service via FMP/NOTIFY protocol dissector crash

Wireshark: Wireshark: Denial of Service via pcapng file parser crash

wireshark: Wireshark: Denial of service via SSH protocol dissector crash

wireshark: Wireshark: Denial of Service via UMTS FP protocol dissector crash

wireshark: Wireshark: Denial of Service via DBS Etherwatch file parser crash

wireshark: Wireshark: Denial of service via Z39.50 protocol dissector crash

wireshark: Wireshark: Denial of Service via TLS ECH decryptor crash

wireshark: Wireshark: Denial of Service via multiple protocol dissector infinite loops

wireshark: Wireshark: Denial of Service vulnerability in ciscodump

gitlab: GitLab EE: Auditor-level users can modify compliance records via improper authorization in GraphQL

gitlab-ee: gitlab: GitLab: Information disclosure of private project existence via improper authorization

gitlab-ee: GitLab EE: Information disclosure via improper authorization controls

gitlab: GitLab: Arbitrary script execution via improper input sanitization

asyncssh: AsyncSSH: Arbitrary file write via path traversal in SCP client

wasmtime: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi

pypdf: pypdf: Denial of Service via crafted PDF inline image

litellm: LiteLLM: Information disclosure via local file read in test connection endpoint

litellm: LiteLLM: Directory traversal via crafted skill archive upload

onnx: ONNX: Denial of Service via crafted untrusted models

litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails

guardrails-detectors: guardrails-detectors: Unauthenticated Regular-Expression Denial of Service (ReDoS) via detector_params.regex

github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling

OpenVPN Access Server: OpenVPN Access Server: HTTP request smuggling via bare line-feed sequences in HTTP headers

@opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding

Palo Alto Networks security advisory: https://security.paloaltonetworks.com/CVE-2026-0276

Palo Alto Networks security advisory: https://security.paloaltonetworks.com/CVE-2026-0277

Palo Alto Networks security advisory: https://security.paloaltonetworks.com/CVE-2026-0278

Palo Alto Networks security advisory: https://security.paloaltonetworks.com/CVE-2026-0279

Palo Alto Networks security advisory: https://security.paloaltonetworks.com/CVE-2026-0280

Palo Alto Networks security advisory: https://security.paloaltonetworks.com/CVE-2026-0281