CVE Vulnerability Catalog

Unclear documentation of error behavior in `ParseWithClaims` in golang-jwt can lead to users not checking errors properly. Especially, if a token is both expired and invalid, the returned errors may be misleading.

No description is available for CVE-2026-6502. The nature of the vulnerability cannot be determined.

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity for specially crafted HTML inputs, which can lead to denial of service (DoS).

A segmentation fault was discovered in the libde265 library (commit d9fea9d) in the decoder_context::compute_framedrop_table() function. This vulnerability may cause crashes in applications using this library.

An issue was discovered in py-lmdb 0.97 where for certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. This occurs when accessing a data.mdb file supplied by an attacker.

In libxml2 before 2.12.10 and 2.13.6, a stack-based buffer overflow exists in xmlSnprintfElements in valid.c. Exploitation requires DTD validation of an untrusted document or untrusted DTD. Similar to CVE-2017-9047.

In libxml2 before 2.12.10 and 2.13.6, a use-after-free exists in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. Exploitation requires validation of a crafted XML document against an XML schema with identity constraints or a crafted schema.

In libxml2 before 2.11.0, xmlXIncludeAddNode in xinclude.c has a use-after-free vulnerability.

Multiple security vulnerabilities have been identified in the grpc-go library affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation. These vulnerabilities could lead to authorization bypass (Fail-Open) during rule translation.

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This may allow an attacker to trigger memory allocation failures, causing a segmentation fault and application crash.

A flaw was found in Poppler's Pdfinfo utility. Using the -dests parameter with a malformed input file can cause the utility to crash.

In libxslt before 1.1.43, xsltGetInheritedNsList has a use-after-free issue related to exclusion of result prefixes.

The Diffie-Hellman Key Agreement Protocol allows long exponents, making certain calculations unnecessarily expensive. The 1996 van Oorschot and Wiener paper showed that appropriately short exponents can be used with adequate subgroup constraints, but these are not utilized.

Checking excessively long DSA keys or parameters may be very slow. Applications using EVP_PKEY_param_check() or EVP_PKEY_public_check() to verify DSA public keys or parameters may experience long delays.

In PHP versions 8.3.x before 8.3.19 and 8.4.x before 8.4.5, a code sequence involving the __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability.

In CPython, the venv module and CLI do not properly quote paths when creating a virtual environment, allowing injection of commands into activation scripts (e.g., source venv/bin/activate). This enables arbitrary code execution upon activation.

An integer overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when using the "-ImgDir" command line option on a directory containing 1048576 files.

In libxml2 before 2.12.10 and 2.13.6, a NULL pointer dereference exists in xmlPatMatch in pattern.c.

Windows libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

A high severity vulnerability in the CPython zipfile module affecting zipfile.Path. When iterating over entry names in a zip archive (e.g., namelist(), iterdir()), unexpected behavior may occur. The more common zipfile.ZipFile class is unaffected.