CVE Vulnerability Catalog

Picomatch to matcher glob napisany w JavaScript. Wersje przed 4.0.4, 3.0.2 i 2.3.2 są podatne na atak typu Regular Expression Denial of Service (ReDoS) podczas przetwarzania stworzonych wzorców extglob.

A memory-related vulnerability has been discovered and fixed in the librsvg dependency. Under certain runtime-specific conditions, it can lead to possible remote code execution (RCE) on glibc-based Linux.

The faraday-http-cache library stores cached responses in JSON format by default and reads them back using JSON.load, which honors the json_class key and calls json_create on the named class. Response headers are stored verbatim in the cache entry, so a malicious origin server can return a response with a json_class key leading to unsafe deserialization.

A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.

A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.

A divide-by-zero error was discovered in py-lmdb 0.97 in the mdb_env_open2 function when mdb_env_read_header obtains a zero value for a certain size field. This issue can be triggered by supplying a crafted data.mdb file.

Several vulnerabilities have been discovered and fixed in the upstream libvips dependency, two rated as high severity using CVSSv4. Versions of sharp prior to 0.35.0 processing untrusted input are affected.

A call to the token endpoint with a grant type of urn:ietf:params:oauth:grant-type:device_code and a bogus device_code can obtain a bearer token as long as a valid client ID enabled for the device workflow is known. This violates RFC 8628.

The description of this report does not contain sufficient technical information about the vulnerability — it only includes a note about the reporting method and references to files that were not attached. The nature and scope of the issue cannot be determined from it.

Multiple cases were found in aiohttp where excessive or unbounded memory use, or excessive CPU consumption, can be triggered by attacker-controlled requests. An attacker could cause resource exhaustion through specially crafted requests.

GitPython spent 2022-2026 rolling out two reusable guards method-by-method: Git.check_unsafe_protocols(url) (raises UnsafeProtocolError for <transport>:: remote-helper URLs) and Git.check_unsafe_options(...) (raises UnsafeOptionError for denylisted options). The description indicates the rollout did not cover all code paths.

GitPython's config-name validator only neutralizes CR/LF/NUL for the "option" label; it does not reject =, #, ;, [, ], or whitespace in an option name. write_section writes the option name verbatim into the config file, so an option name such as sshCommand = touch <cmd> can inject configuration.

In Pillow's libtiff encoder (PyImaging_LibTiffEncoderNew in src/encode.c), crafted TIFF tags can cause memory disclosure and a segfault. The issue occurs when creating the LibTiff encoder.

Pillow wheels from 11.1.0 onward bundle a libopenjp2 containing a heap-buffer-overflow write that is fixed upstream on master but has never appeared in an OpenJPEG release. Because the wheel bundles its own copy, a patched host library does not protect against the issue.

The wheels of pyca/cryptography include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue.