Security Vulnerabilities
Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS Score
8.8
EPSS Score
0.003
Published
2026-10-30
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.
CVSS Score
7.1
EPSS Score
0.003
Published
2026-10-29
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
CVSS Score
7.5
EPSS Score
0.004
Published
2026-10-29
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.
CVSS Score
7.5
EPSS Score
0.004
Published
2026-10-29
Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
CVSS Score
8.8
EPSS Score
0.006
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.
CVSS Score
9.8
EPSS Score
0.022
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.
CVSS Score
6.5
EPSS Score
0.004
Published
2026-10-29
Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
CVSS Score
4.3
EPSS Score
0.004
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.
CVSS Score
6.5
EPSS Score
0.004
Published
2026-10-29