CWE-1395.

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder

• CWE-1395

Trust of compromised eMudhra root CA in bundled CA stores

• Checkmk
• Weak cryptography or TLS
• CWE-1395

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

• Memory corruption
• CWE-1395

>=11.1.0, <13.0.0 · fixed in 13.0.0

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

• CWE-1395

>=10.0.0, <15.5.28 || >=16.0.0, <16.4.1 · fixed in 15.5.28, 16.4.1

Ghost: Remote Code Execution via Bookmark Card Images

• Code injection
• CWE-1395

>=6.56.0, <6.67.0 · fixed in 6.67.0

sharp : Vulnerability in librsvg dependency CVE-2026-96889

• Memory corruption
• CWE-1395

<0.35.5 · fixed in 0.35.5

Next.js: Remote Code Execution in next/og ImageResponse

• CWE-1395

>=16.2.0, <16.3.6 · fixed in 16.3.6

DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

• Wikimedia Foundation Mediawiki - DataTransfer Extension
• Denial of service
• CWE-1395

Dependency on vulnerable third-party component in Malcolm

• CISA Malcolm
• CWE-1395

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

• CWE-1395

>=10.0.0, <15.5.24 || >=16.0.0, <16.3.3 · fixed in 15.5.24, 16.3.3

Windows Secure Boot Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-1395

Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services)

• SAP_SE SAP NetWeaver AS Java (Adobe Document Services)
• CWE-1395

olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193

• CWE-1395

<=8.0.6 · no fixed version yet

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp

• ZAPAD Image::WebP
• CWE-1395

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99

• FELIPE TOML::XS
• CWE-1104
• CWE-1395

Oracle Corporation Oracle Platform Security for Java: Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion…

• Oracle Corporation Oracle Platform Security for Java
• CWE-1395

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

• CWE-1395

<0.35.0 · fixed in 0.35.0

Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers

• logto
• Other injection
• CWE-1395

Gogs: XSS in .ipynb files renderer due to outdated notebookjs

• Cross-site scripting (XSS)
• CWE-1395

<0.14.3 · fixed in 0.14.3

OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL

• CWE-1395

<1.11.10 || >=1.12.0-beta1, <1.12.3 · fixed in 1.11.10, 1.12.3

Vulnerable OpenSSL included in cryptography wheels

• Memory corruption
• CWE-1395

>=0.5.0, <48.0.1 · fixed in 48.0.1

Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395)

• Adobe Dreamweaver Desktop
• CWE-1395

HCL iReflection Use of Third party vulnerable and outdated components issue was detected in the web application.

• HCL iReflection
• CWE-1395

Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks

• Ditec a.s. D.Launcher 2
• Other injection
• Information disclosure

HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'

• HCL BigFix Service Management (SM)
• CWE-1395

Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component

• Hitachi Vantara Pentaho Data Integration and Analytics
• CWE-1395

Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)

• Adobe Commerce
• Adobe Commerce B2B
• CWE-1395

Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)

• Adobe Commerce
• Adobe Commerce B2B
• CWE-1395

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries

• KMX Alien::FreeImage
• CWE-1395

HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability

• HCL DFXAnalytics
• CWE-1395

Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

• Cross-site scripting (XSS)
• CWE-1395

>=0.18.0, <0.18.1 · fixed in 0.18.1

Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt

• ATRODO Net::Dropbear
• CWE-1395

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses

• CWE-1395

<1.11.6 · fixed in 1.11.6

Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions

• CWE-508
• CWE-1395

>=0.1800.0, <0.2695.1 · fixed in 0.2695.1

Axios npm Supply Chain Incident Impacting @usebruno/cli

• CWE-494
• CWE-506

<3.2.1 · fixed in 3.2.1

mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

• Race condition
• CWE-1395

<1.1.0 · fixed in 1.1.0

EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory

• CWE-129
• CWE-1395

>=1.0.0-beta.1, <1.0.0-beta.3 · fixed in 1.0.0-beta.3

Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library

• YVES Sereal::Encoder
• CWE-1395

Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library

• YVES Sereal::Decoder
• CWE-1395

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib

• SHAY perl
• CWE-1395

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)

• Broken access control
• CWE-1395

<2.11.42 · fixed in 2.11.42

Postiz App has a High-Severity SSRF Vulnerability via Next.js

• Server-side request forgery (SSRF)
• CWE-1395

<=2.0.12 · no fixed version yet

C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)

• Denial of service
• CWE-1395

<1.1.66 · fixed in 1.1.66

splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution

• Insecure deserialization
• CWE-1395

<2.26.1 · fixed in 2.26.1

fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing

• Memory corruption
• CWE-126

<3.5.8 · fixed in 3.5.8

skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version

• Memory corruption
• CWE-1395

<144.0.post1 · fixed in 144.0.post1

Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

• CWE-436
• CWE-1395

<1.4.1 · fixed in 1.4.1

Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121

• Weak cryptography or TLS
• CWE-1395

<1.2.3-0.20260316182343-b3364f3f32e7 · fixed in 1.2.3-0.20260316182343-b3364f3f32e7

GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability

• Microsoft GitHub Repo: Zero Shot scFoundation
• CWE-1395

UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library

• TOKUHIROM UnQLite
• CWE-1395

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib

• PMQS Compress::Raw::Zlib
• CWE-1395

Traefik affected by TLS ClientAuth Bypass on HTTP/3

• CWE-1395

<=1.7.34 · no fixed version yet

Centrifugo v6.6.0 dependency vulnerabilities

• CWE-1395

<6.6.1 · fixed in 6.6.1

Gogs vulnerable to Stored XSS via Mermaid diagrams

• Cross-site scripting (XSS)
• CWE-1395

<0.13.4 · fixed in 0.13.4

FrankenPHP has delayed propagation of security fixes in upstream base images

• CWE-1395

<1.1.11 · fixed in 1.1.11

OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format

• Denial of service
• CWE-1395

<1.11.4 · fixed in 1.11.4

HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability

• JV HarfBuzz::Shaper
• CWE-1395

Spectrum outdated java library in class-path

• Broadcom DX NetOps Spectrum
• CWE-1395

Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium

• IAMB Crypt::Sodium::XS
• CWE-1395

Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency

• Broken access control
• CWE-1395

>=5.0.0-BETA0, <5.5.0 · fixed in 5.5.0