漏洞公告

pypdf: Possible long runtimes/large memory usage when retrieving outlines

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

pypdf: Possible infinite loop for TreeObject.insert_child

sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

nanoid: Integer Overflow or Wraparound

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials