Recently updated CVEs

Nov 13, 2026 UTC

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Nov 13, 2026 UTC

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Nov 13, 2026 UTC

GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints …

Nov 13, 2026 UTC

Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: …

Nov 13, 2026 UTC

Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX. With match_uri_encoded_slash enabled and skip_mtls_uri_regex configured, a client without a certificate can reach an upstream behind a route that requires one, limited to request paths …

Nov 13, 2026 UTC

Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from …

Nov 13, 2026 UTC

Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue affects Apache…

Nov 13, 2026 UTC

Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse en…

Nov 13, 2026 UTC

Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can h…

Nov 13, 2026 UTC

Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented he…

Nov 13, 2026 UTC

Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent.

Nov 13, 2026 UTC

Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow …

Nov 13, 2026 UTC

A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against …

Nov 13, 2026 UTC

PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop owne…

Nov 13, 2026 UTC

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested …