azure linux python-tensorboard vulnerabilities

Latest azure linux python-tensorboard CVEs

Newest publication first · page 1 of 4

1. CVE-2026-123611 rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello

   Published 2026-11-08

   Medium·CVSS 6.3 EPSS 0.19%

   rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later C...

2. CVE-2026-119191 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

   Published 2026-10-29

   High·CVSS 7.5

   Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored...

3. CVE-2026-119190 Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

   Published 2026-10-29

   High·CVSS 7.4

   Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name....

4. CVE-2026-119189 Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

   Published 2026-10-29

   Medium·CVSS 5.9

   Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation require...

5. CVE-2026-119188 Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

   Published 2026-10-29

   High·CVSS 7.5

   Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision....

6. CVE-2026-119187 Forge: Denial of service in TLS record processing via call stack exhaustion

   Published 2026-10-29

   High·CVSS 7.5

   Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge proc...

7. CVE-2026-119186 Forge: AES-GCM authentication bypass via unvalidated tagLength option

   Published 2026-10-29

   Medium·CVSS 5.9

   Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tag...

8. CVE-2026-118782 Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

   Published 2026-10-29

   High·CVSS 7.5

   Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key in...

9. CVE-2026-118781 Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

   Published 2026-10-29

   Low·CVSS 2.9

   Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security de...

10. CVE-2026-118780 Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

    Published 2026-10-29

    Low·CVSS 3.7

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. nod...

11. CVE-2026-118779 Forge: Regular expression denial of service in PEM decoding (pem.decode)

    Published 2026-10-29

    High·CVSS 7.5

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time reg...

12. CVE-2026-118778 Forge: TLS client crash when the server sends no certificate

    Published 2026-10-29

    Medium·CVSS 5.9

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. no...

13. CVE-2026-118777 Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

    Published 2026-10-29

    Medium·CVSS 4.8

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name p...

14. CVE-2026-118776 Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

    Published 2026-10-29

    Low·CVSS 3.7

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-forge validated only...

15. CVE-2026-118775 Forge: ASN.1 OID first arc truncation in asn1.oidToDer

    Published 2026-10-29

    Low·CVSS 3.7

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that s...

16. CVE-2026-118774 Forge: Certificate signature verified with the issuer's RSA signature scheme

    Published 2026-10-29

    Low·CVSS 3.7

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input or security decision. node-forge selected...

17. CVE-2026-119025 open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows

    Published 2026-10-29

    High·CVSS 7.7

    open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP...

18. CVE-2026-116137 adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

    Published 2026-10-25

    Medium·CVSS 6.3

    adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates be...

19. CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

    Published 2026-10-23

    Low·CVSS 2.1

    Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly...

20. CVE-2026-115754 serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

    Published 2026-10-23

    Low·CVSS 2.3

    serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toSt...

21. CVE-2026-111181 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

    Published 2026-10-22

    High·CVSS 7.5

    body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parse...

22. CVE-2026-112085 webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

    Published 2026-10-22

    High·CVSS 8.2

    webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without...

23. CVE-2026-91403 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u5...

    Published 2026-10-21

    Critical·CVSS 9.1

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JD...

24. CVE-2026-87294 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE:...

    Published 2026-10-20

    Medium·CVSS 6.5

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalV...

25. CVE-2026-87290 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u5...

    Published 2026-10-20

    Medium·CVSS 5.9

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM fo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.