Open Source Vulnerabilities

pypdf

pypdf has possible large memory usage when parsing cross-reference streams

pyasn1

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

pyasn1

pyasn1 has quadratic-complexity denial of service in binary REAL decoding

pyasn1

pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding

pyasn1

pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding

node-forge

Forge: ASN.1 OID first arc truncation in asn1.oidToDer

node-forge

Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

node-forge

Forge: TLS client crash when the server sends no certificate

node-forge

Forge: Regular expression denial of service in PEM decoding (pem.decode)

node-forge

Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

node-forge

Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

node-forge

Forge: AES-GCM authentication bypass via unvalidated tagLength option

node-forge

Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

node-forge

Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

node-forge

Forge: Denial of service in TLS record processing via call stack exhaustion

node-forge

Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

phpunit/phpunit

PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

@nuxt/vite-builder

Nuxt dev server exposes generated appSecret through Vite file serving

nuxt, @nuxt/nitro-server

Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

@nuxt/vite-builder

Nuxt dev server arbitrary file read through client error reports

@nuxt/vite-builder

Nuxt dev server exposes private runtime config through the Nitro dev bundle

@sigstore/oci

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client

MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client

MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client

MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client

MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client, org.mariadb.jdbc:mariadb-java-client

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

follow-redirects

follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

russh

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

pageant

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

russh

russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

russh

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

russh

russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

graphql-core

GraphQL-core has denial of service via memory leak in aborted validations

oauthlib

OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

openwisp-controller

OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

github.com/gofiber/fiber/v2

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

signalk-server

signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher

signalk-server, @signalk/resources-provider

Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

github.com/imgproxy/imgproxy/v3, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution

github.com/imgproxy/imgproxy/v3

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash

github.com/imgproxy/imgproxy/v3

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field

github.com/anacrolix/torrent

anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

adminneo-org/adminneo

AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

adminneo-org/adminneo

AdminNeo SQLite Database-List Drop Arbitrary File Deletion

adminneo-org/adminneo

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

adminneo-org/adminneo

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

adminneo-org/adminneo

AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)

adminneo-org/adminneo

AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery

gov.nsa.emissary:emissary

NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571