Tagged “vex”
CVEs tagged vex, newest first.
7401 CVEsRSS
CVE-2026-115373Medium· 6.3PoCIncus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restr…
CVE-2026-115374High· 7.1github.com/lxc/incus: incus: Information disclosure via unsigned headers in presigned S3 URLs (CVE-2026-115374)
A flaw was found in Incus. The built-in Simple Storage Service (S3) server does not properly verify request signatures, allowing an attacker with a presigned upload URL to inject unsigned request headers. By supplying an unauthorized copy …
CVE-2026-115372High· 8.5Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and tr…
CVE-2026-115365Medium· 6.6github.com/openbao/openbao: OpenBao: Privilege escalation via ACL policy cache namespace traversal (CVE-2026-115365)
A flaw was found in OpenBao. An authenticated attacker can bypass authorization boundaries by assigning specially crafted policy names to tokens, allowing the tokens to reference cached Access Control List (ACL) policies from other namespa…
CVE-2026-115355High· 7.5Mistune before 3.3.0 Path Traversal and XSS via Include Directive
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messa…
CVE-2026-115354Medium· 6.5PoCMistune before 3.3.0 Arbitrary Local File Read via Include Directive
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.r…
CVE-2026-115352High· 7.5Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown p…
CVE-2026-115351Medium· 4.7PoCMistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option
Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can app…
CVE-2026-115350Medium· 6.1Mistune before 3.3.0 Stored XSS via Include Directive HTML Files
Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer c…
CVE-2026-115349High· 7.5Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering qua…
CVE-2026-115348High· 7.5Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Mar…
CVE-2026-115347High· 7.5Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing lon…
CVE-2026-111497Critical· 9.8CISA KEVPoCBrotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
CVE-2026-97631Critical· 9.5Pre-boot RCE in EDK II PXE driver
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary…
CVE-2026-114605High· 7.5dnspython dns.name.from_wire_parser() excessive CPU use
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal du…
CVE-2026-115319Low· 2.5fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents
fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly…
CVE-2026-114348Medium· 5.3webpack-dev-server: webpack-dev-server: Information disclosure via malformed Host header (CVE-2026-114348)
A flaw was found in webpack-dev-server. An unauthenticated remote attacker can exploit improper Host header validation in the open-editor endpoint to obtain sensitive technical information. By sending a request with a specially crafted Hos…
CVE-2026-96640High· 8.2PoCPillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-96644High· 8.1PoCPillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
CVE-2026-96643High· 6.5Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
CVE-2026-96778High· 7.7PoCPillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
CVE-2026-111997Medium· 5.3PoCip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
CVE-2026-105483High· 7.4PoCnodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the in…
CVE-2026-106069High· 7.4PoCnodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause c…
CVE-2026-105482High· 7.4PoCnodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolv…
CVE-2026-115424Medium· 5.5oc: oc: Symlink/hardlink target validation bypass in oc image extract allows file write outside destination (CVE-2026-115424)
A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of th…
CVE-2026-91403Critical· 9.1PoC⚖ disputedVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21…
CVE-2026-114138High· 7.5PoCDjango REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer …
CVE-2026-114137High· 7.4Django REST framework: TokenProxy.delete() reports success and revokes nothing
Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, …
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
A flaw was found in nbconvert. This flaw allows an attacker to perform an arbitrary file write by enticing a user to convert a maliciously crafted Jupyter notebook. Due to improper path validation in ExtractOutputPreprocessor, attacker-con…