CVE-2026-57199 - Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
CVE ID :CVE-2026-57199
Published : Oct. 27, 2026, 9:52 p.m. | 15 minutes ago
Description :Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers` without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the `SMS` dialplan application, which is useful when routing calls to or from `analog devices`, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-57199
Published : Oct. 27, 2026, 9:52 p.m. | 15 minutes ago
Description :Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers` without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the `SMS` dialplan application, which is useful when routing calls to or from `analog devices`, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118351 - Google Chrome Skia Memory Corruption
CVE ID :CVE-2026-118351
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118351
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118352 - Google Chrome Cache Memory Corruption
CVE ID :CVE-2026-118352
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118352
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118353 - Google Chrome Paint Use-After-Free Vulnerability
CVE ID :CVE-2026-118353
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118353
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118354 - Google Chrome Skia Improper Input Validation Vulnerability
CVE ID :CVE-2026-118354
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118354
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118355 - Google Chrome Command Improper Input Validation Remote Code Execution
CVE ID :CVE-2026-118355
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118355
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118356 - Google Chrome WTF Use-After-Free Vulnerability
CVE ID :CVE-2026-118356
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118356
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118357 - Google Chrome FileSystem Use-After-Free Vulnerability
CVE ID :CVE-2026-118357
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118357
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118358 - Google Chrome WebAudio Memory Corruption
CVE ID :CVE-2026-118358
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118358
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118359 - Google Chrome V8 Memory Corruption
CVE ID :CVE-2026-118359
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118359
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18326 - Rejected reason: This CVE ID has been rejected or
CVE ID :CVE-2026-18326
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18326
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-22063 - CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products
CVE ID :CVE-2026-22063
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.
Severity: 6.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-22063
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.
Severity: 6.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-50571 - WebSub: Reflected script execution through intent-verification challenges
CVE ID :CVE-2026-50571
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. Subscribers that return the challenge as `text/html` can execute the reflected content in the subscriber origin, using a victim's existing session to read private data or perform actions, exposing `localStorage` or `sessionStorage` and browser permissions granted to that origin. An alternative uses the verification response as an attacker-controlled same-origin script resource to bypass `script-src 'self'`; this can remain possible with `application/octet-stream` when MIME sniffing is allowed. Safe media typing and `X-Content-Type-Options: nosniff` are both needed to address the described scenarios. WebSub Rocks demonstrated reflection, but the advisory does not establish practical impact on that demonstration site.
Severity: 5.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-50571
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. Subscribers that return the challenge as `text/html` can execute the reflected content in the subscriber origin, using a victim's existing session to read private data or perform actions, exposing `localStorage` or `sessionStorage` and browser permissions granted to that origin. An alternative uses the verification response as an attacker-controlled same-origin script resource to bypass `script-src 'self'`; this can remain possible with `application/octet-stream` when MIME sniffing is allowed. Safe media typing and `X-Content-Type-Options: nosniff` are both needed to address the described scenarios. WebSub Rocks demonstrated reflection, but the advisory does not establish practical impact on that demonstration site.
Severity: 5.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-58205 - GRR has a Reflected XSS issue
CVE ID :CVE-2026-58205
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-58205
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-58255 - Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
CVE ID :CVE-2026-58255
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-58255
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 52 minutes ago
Description :Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-58256 - GRR vulnerable to Remote Code Execution Via PHP Code Injection
CVE ID :CVE-2026-58256
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 51 minutes ago
Description :GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.
Severity: 9.1 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-58256
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 51 minutes ago
Description :GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.
Severity: 9.1 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-58257 - GRR vulnerable to Arbitrary File Read and Deletion
CVE ID :CVE-2026-58257
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 51 minutes ago
Description :GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-58257
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 51 minutes ago
Description :GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-58496 - ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API
CVE ID :CVE-2026-58496
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 51 minutes ago
Description :Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-58496
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 51 minutes ago
Description :Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-59158 - Nuxt Ollama: public runtime configuration discloses the configured cloud API key
CVE ID :CVE-2026-59158
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 51 minutes ago
Description :Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-59158
Published : Oct. 27, 2026, 11:17 p.m. | 2 hours, 51 minutes ago
Description :Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-104016 - jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError
CVE ID :CVE-2026-104016
Published : Oct. 28, 2026, 12:17 a.m. | 1 hour, 51 minutes ago
Description :ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit. The JVM refuses arrays larger than Integer.MAX_VALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured. A February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-104016
Published : Oct. 28, 2026, 12:17 a.m. | 1 hour, 51 minutes ago
Description :ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit. The JVM refuses arrays larger than Integer.MAX_VALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured. A February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-104895 - jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
CVE ID :CVE-2026-104895
Published : Oct. 28, 2026, 12:17 a.m. | 1 hour, 51 minutes ago
Description :The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-104895
Published : Oct. 28, 2026, 12:17 a.m. | 1 hour, 51 minutes ago
Description :The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...