{"version":1,"updatedAt":"2026-10-30T01:34:06.206Z","totalRecords":416837,"items":[{"id":"CVE-2026-119325","state":"PUBLISHED","title":"Bricks Theme Broken Access Control via load_popup_content","description":"Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the p","publishedAt":"2026-10-29T20:34:52.827Z","updatedAt":"2026-10-29T20:34:52.827Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Bricks Bricks Theme"]},{"id":"CVE-2026-119317","state":"PUBLISHED","title":"Incorrect Authorization","description":"On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.","publishedAt":"2026-10-29T21:13:04.494Z","updatedAt":"2026-10-29T21:13:04.494Z","severity":{"score":6,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"tenable"},"assigner":"tenable","products":["Tenable, Inc. Plugin Feed"]},{"id":"CVE-2026-119286","state":"PUBLISHED","title":"GraphQL-core: Denial of service via memory leak in aborted validations","description":"GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a","publishedAt":"2026-10-29T21:38:43.633Z","updatedAt":"2026-10-29T21:38:43.633Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["graphql-python graphql-core"]},{"id":"CVE-2026-119285","state":"PUBLISHED","title":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","description":"Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin ","publishedAt":"2026-10-29T21:36:02.199Z","updatedAt":"2026-10-29T21:36:02.199Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["gofiber fiber"]},{"id":"CVE-2026-119284","state":"PUBLISHED","title":"joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection","description":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signatur","publishedAt":"2026-10-29T21:33:16.529Z","updatedAt":"2026-10-29T21:33:16.529Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["authlib joserfc"]},{"id":"CVE-2026-119283","state":"PUBLISHED","title":"joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption","description":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose","publishedAt":"2026-10-29T21:10:05.490Z","updatedAt":"2026-10-29T21:10:05.490Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["authlib joserfc"]},{"id":"CVE-2026-119282","state":"PUBLISHED","title":"Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle","description":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore b","publishedAt":"2026-10-29T21:07:46.468Z","updatedAt":"2026-10-29T21:07:46.468Z","severity":{"score":7.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["nrwl nx","@nx maven","@nx gradle"]},{"id":"CVE-2026-119281","state":"PUBLISHED","title":"MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-se","publishedAt":"2026-10-29T20:58:39.322Z","updatedAt":"2026-10-29T20:58:39.322Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["mariadb-corporation mariadb-connector-j"]},{"id":"CVE-2026-119280","state":"PUBLISHED","title":"MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against ","publishedAt":"2026-10-29T20:55:50.101Z","updatedAt":"2026-10-29T20:55:50.101Z","severity":{"score":3.7,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"GitHub_M"},"assigner":"GitHub_M","products":["mariadb-corporation mariadb-connector-j"]},{"id":"CVE-2026-119279","state":"PUBLISHED","title":"MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's unsigned 8-byte length-encoded integer to a Java int without checking that the value fit a non-negative integer. Values above Integer.MAX_VA","publishedAt":"2026-10-29T20:52:22.903Z","updatedAt":"2026-10-29T20:52:22.903Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["mariadb-corporation mariadb-connector-j"]},{"id":"CVE-2026-119278","state":"PUBLISHED","title":"MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the server-declared length, and authResult[0] was accessed without ensuring a byte existed. A malicious or comp","publishedAt":"2026-10-29T20:50:35.474Z","updatedAt":"2026-10-29T20:50:35.474Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["mariadb-corporation mariadb-connector-j"]},{"id":"CVE-2026-119277","state":"PUBLISHED","title":"MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create su","publishedAt":"2026-10-29T20:49:24.148Z","updatedAt":"2026-10-29T20:49:24.148Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["mariadb-corporation mariadb-connector-j"]},{"id":"CVE-2026-119276","state":"PUBLISHED","title":"MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info field and session-state variable names and values before confirming that the bytes","publishedAt":"2026-10-29T20:47:32.086Z","updatedAt":"2026-10-29T20:47:32.086Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["mariadb-corporation mariadb-connector-j"]},{"id":"CVE-2026-119272","state":"PUBLISHED","title":"Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security sev","description":"Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","publishedAt":"2026-10-30T00:05:10.337Z","updatedAt":"2026-10-30T00:05:10.337Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119271","state":"PUBLISHED","title":"Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se","description":"Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:10.204Z","updatedAt":"2026-10-30T00:05:10.204Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119270","state":"PUBLISHED","title":"Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted H","description":"Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:10.072Z","updatedAt":"2026-10-30T00:05:10.072Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119269","state":"PUBLISHED","title":"Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s","description":"Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:09.940Z","updatedAt":"2026-10-30T00:05:09.940Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119268","state":"PUBLISHED","title":"Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chr","description":"Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:09.805Z","updatedAt":"2026-10-30T00:05:09.805Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119267","state":"PUBLISHED","title":"Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromi","description":"Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:09.662Z","updatedAt":"2026-10-30T00:05:09.662Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119266","state":"PUBLISHED","title":"Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromiu","description":"Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:09.521Z","updatedAt":"2026-10-30T00:05:09.521Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119265","state":"PUBLISHED","title":"Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chro","description":"Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:09.381Z","updatedAt":"2026-10-30T00:05:09.381Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119264","state":"PUBLISHED","title":"Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chrom","description":"Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:09.239Z","updatedAt":"2026-10-30T00:05:09.239Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119263","state":"PUBLISHED","title":"Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTM","description":"Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:09.101Z","updatedAt":"2026-10-30T00:05:09.101Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119262","state":"PUBLISHED","title":"Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. ","description":"Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:08.953Z","updatedAt":"2026-10-30T00:05:08.953Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119261","state":"PUBLISHED","title":"Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML pag","description":"Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:08.810Z","updatedAt":"2026-10-30T00:05:08.810Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119260","state":"PUBLISHED","title":"Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security ","description":"Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","publishedAt":"2026-10-30T00:05:08.673Z","updatedAt":"2026-10-30T00:05:08.673Z","severity":null,"assigner":"Chrome","products":["Google Chrome"]},{"id":"CVE-2026-119251","state":"PUBLISHED","title":"A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host","description":"A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.","publishedAt":"2026-10-29T18:29:46.417Z","updatedAt":"2026-10-29T20:39:44.834Z","severity":{"score":6.7,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"Ubiquiti"},"assigner":"Ubiquiti","products":["Ubiquiti Inc WiFiman Desktop for macOS"]},{"id":"CVE-2026-119250","state":"PUBLISHED","title":"A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary ","description":"A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.","publishedAt":"2026-10-29T18:26:35.631Z","updatedAt":"2026-10-29T20:40:19.471Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Ubiquiti"},"assigner":"Ubiquiti","products":["Ubiquiti Inc WiFiman Desktop for macOS"]},{"id":"CVE-2026-119249","state":"PUBLISHED","title":"A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the ","description":"A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the host device.","publishedAt":"2026-10-29T18:23:36.670Z","updatedAt":"2026-10-29T20:40:49.706Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"Ubiquiti"},"assigner":"Ubiquiti","products":["Ubiquiti Inc WiFiman Desktop for macOS"]},{"id":"CVE-2026-119210","state":"PUBLISHED","title":"MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a m","publishedAt":"2026-10-29T20:45:38.135Z","updatedAt":"2026-10-29T20:45:38.135Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["mariadb-corporation mariadb-connector-j"]},{"id":"CVE-2026-119209","state":"PUBLISHED","title":"pypdf: Possible large memory usage when parsing cross-reference streams","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is","publishedAt":"2026-10-29T20:43:03.072Z","updatedAt":"2026-10-29T20:43:03.072Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["py-pdf pypdf"]},{"id":"CVE-2026-119208","state":"PUBLISHED","title":"pypdf: Possible long runtimes/large memory usage for encrypted PDF files","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled val","publishedAt":"2026-10-29T20:41:02.879Z","updatedAt":"2026-10-29T20:41:02.879Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["py-pdf pypdf"]},{"id":"CVE-2026-119207","state":"PUBLISHED","title":"pypdf: Possible large memory usage for exceptions in strict mode","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3.","publishedAt":"2026-10-29T20:38:54.611Z","updatedAt":"2026-10-29T20:38:54.611Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["py-pdf pypdf"]},{"id":"CVE-2026-119206","state":"PUBLISHED","title":"pypdf: Possible long runtimes when retrieving page labels","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label rang","publishedAt":"2026-10-29T20:37:15.057Z","updatedAt":"2026-10-29T20:37:15.057Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["py-pdf pypdf"]},{"id":"CVE-2026-119205","state":"PUBLISHED","title":"pypdf: Possible infinite loop when cloning dictionaries","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.","publishedAt":"2026-10-29T20:35:33.902Z","updatedAt":"2026-10-29T20:35:33.902Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["py-pdf pypdf"]},{"id":"CVE-2026-119204","state":"PUBLISHED","title":"pypdf: Possible large memory usage when parsing page tree","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in vers","publishedAt":"2026-10-29T20:34:02.704Z","updatedAt":"2026-10-29T20:34:02.704Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["py-pdf pypdf"]},{"id":"CVE-2026-119203","state":"PUBLISHED","title":"pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search","description":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is ","publishedAt":"2026-10-29T20:30:13.426Z","updatedAt":"2026-10-29T20:30:13.426Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["py-pdf pypdf"]},{"id":"CVE-2026-119202","state":"PUBLISHED","title":"@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service","description":"@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before ro","publishedAt":"2026-10-29T20:24:17.210Z","updatedAt":"2026-10-29T20:24:17.210Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["hapijs content"]},{"id":"CVE-2026-119201","state":"PUBLISHED","title":"Nuxt dev server exposes generated appSecret through Vite file serving","description":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSessi","publishedAt":"2026-10-29T20:21:27.895Z","updatedAt":"2026-10-29T20:21:27.895Z","severity":{"score":4.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["nuxt nuxt"]},{"id":"CVE-2026-119200","state":"PUBLISHED","title":"Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes","description":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirect","publishedAt":"2026-10-29T20:17:08.837Z","updatedAt":"2026-10-29T20:17:08.837Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["nuxt nuxt","@nuxt nitro-server"]},{"id":"CVE-2026-119199","state":"PUBLISHED","title":"Nuxt dev server exposes private runtime config through the Nitro dev bundle","description":"Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and lat","publishedAt":"2026-10-29T20:14:07.854Z","updatedAt":"2026-10-29T20:27:59.121Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["nuxt nuxt"]},{"id":"CVE-2026-119198","state":"PUBLISHED","title":"Nuxt dev server arbitrary file read through client error reports","description":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, developme","publishedAt":"2026-10-29T20:11:35.300Z","updatedAt":"2026-10-29T20:11:35.300Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["nuxt nuxt"]},{"id":"CVE-2026-119197","state":"PUBLISHED","title":"pyasn1: Quadratic-complexity denial of service in binary REAL decoding","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly p","publishedAt":"2026-10-29T19:48:52.470Z","updatedAt":"2026-10-29T19:48:52.470Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["pyasn1 pyasn1"]},{"id":"CVE-2026-119196","state":"PUBLISHED","title":"pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctet","publishedAt":"2026-10-29T19:44:46.031Z","updatedAt":"2026-10-29T19:44:46.031Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["pyasn1 pyasn1"]},{"id":"CVE-2026-119195","state":"PUBLISHED","title":"pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects","publishedAt":"2026-10-29T19:41:37.352Z","updatedAt":"2026-10-29T20:26:31.801Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["pyasn1 pyasn1"]},{"id":"CVE-2026-119194","state":"PUBLISHED","title":"pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding","description":"pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of","publishedAt":"2026-10-29T19:38:14.056Z","updatedAt":"2026-10-29T19:38:14.056Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["pyasn1 pyasn1"]},{"id":"CVE-2026-119193","state":"PUBLISHED","title":"PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling","description":"PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and reuses that directory without verifying its ownership or permissions. On multi-user systems with a shared temporary path, a local attacker wh","publishedAt":"2026-10-29T19:35:36.052Z","updatedAt":"2026-10-29T19:35:36.052Z","severity":{"score":5.4,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["sebastianbergmann phpunit"]},{"id":"CVE-2026-119191","state":"PUBLISHED","title":"Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at ","publishedAt":"2026-10-29T19:26:29.815Z","updatedAt":"2026-10-29T19:26:29.815Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["digitalbazaar forge"]},{"id":"CVE-2026-119190","state":"PUBLISHED","title":"Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OI","publishedAt":"2026-10-29T19:25:09.677Z","updatedAt":"2026-10-29T20:25:04.131Z","severity":{"score":7.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["digitalbazaar forge"]},{"id":"CVE-2026-119189","state":"PUBLISHED","title":"Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who ho","publishedAt":"2026-10-29T19:23:25.238Z","updatedAt":"2026-10-29T19:23:25.238Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["digitalbazaar forge"]}],"checkpoint":"b49c5616-6df3-4d26-b5f4-a5c05e84a98f","nextCursor":"eyJraW5kIjoiY2F0YWxvZyIsInNoYXJkIjoiMjAyNi8xMTl4eHgiLCJvZmZzZXQiOjUwfQ"}