CVE-2026-119194 is a high-severity vulnerability in the pyasn1 library used by kimi-cli, where schemaless decoding of BER, CER, or DER data with many distinct long tag IDs causes quadratic CPU usage. This can lead to excessive CPU consumption and reduced availability when processing attacker-controlled inputs. The vulnerability affects versions >=0.56. No confidentiality or integrity impacts have been observed.
pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity relative to the mantissa size, causing excessive CPU consumption. This affects BER, CER, and DER decoders that use the shared RealPayloadDecoder. The vulnerability can be triggered when an application decodes attacker-controlled ASN.1 data containing REAL values without proper input restrictions. The issue is fixed in pyasn1 version 0.6.5.
CVE-2026-119196 is a denial-of-service vulnerability in pyasn1 through version 0.6.4, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption. This occurs because the decoder repeatedly shifts and copies the accumulated value for each fragment, leading to CPU exhaustion during decode(). The vulnerability affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The issue can be triggered by attacker-controlled ASN.1 input if the application accepts such input without sufficient limits.
pyasn1 versions 0.6.4 and earlier contain a denial-of-service vulnerability due to quadratic-time complexity in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This occurs because the decoder repeatedly copies accumulated fragments, causing CPU exhaustion when processing attacker-controlled ASN.1 inputs with many fragments. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5 (high severity).
OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing the authorization checks to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw arises because OAuthlib does not require the client_id in the request body to match the authenticated client's client_id before validating grant types and scopes. As a result, a lower-privilege client can obtain tokens with broader scopes or grant types assigned to a different client. A fix is available in version 11.0.3_1.
The Kimi CLI tool's use of Authlib's RFC 7592 client configuration endpoint contains a security flaw where example code omits verifying that the registration_access_token belongs to the client being accessed. This omission allows an attacker with any valid registration_access_token and knowledge of a client_id to bypass authorization and read, update, or delete that client's registration. The vulnerability affects versions 0.40 and later. The flaw arises because the documented example implementations do not bind the token to the target client, contrary to the protocol's security model. This leads to a high-severity authorization bypass.
Ahmad Umar Agha, a Syrian hacker affiliated with the Syrian Electronic Army, was sentenced to 42 months in a US federal court for a hacking conspiracy directed by Syrian intelligence figures. Over more than a decade, he compromised around 47 targets including Western media, companies, NGOs, and government entities, causing significant disruption and financial losses. Notable incidents include the 2013 hijacking of the Associated Press Twitter account that triggered a stock market flash crash and attacks on the Marine Corps recruiting website and White House social media accounts.
A vulnerability in pdfly's pypdf library allows crafted PDF files with cross-reference streams to cause large memory usage. This issue has been fixed in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-119208 is a vulnerability in pdfly's pypdf component that allows an attacker to craft an encrypted PDF file with a manipulated page count (/Count) value. Accessing the page count in such a file can cause excessive runtimes and large memory usage. This issue affects versions 0.4.0 and later and has been fixed in pypdf version 6.21.3.
CVE-2026-119207 is a vulnerability in pdfly's pypdf component that allows an attacker to craft a malicious PDF causing large memory usage when an invalid dictionary is loaded in strict mode. This can lead to resource exhaustion. The issue affects versions 0.4.0 and later. A fix is available in pypdf version 6.21.3. If upgrading is not possible, applying the changes from pull request #4265 is recommended as a workaround.
CVE-2026-119206 is a vulnerability in pdfly's pypdf component where crafted PDF files can cause long runtimes when retrieving page labels. This can lead to denial-of-service conditions due to resource exhaustion. The issue affects versions 0.4.0 and later. A fix is available in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from pull request #4251 as a workaround.
A vulnerability in pdfly's pypdf library allows an attacker to craft a PDF that triggers an infinite loop when cloning or duplicating a DictionaryObject. This can cause denial of service due to resource exhaustion. The issue affects versions from 0.4.0 onward and has been fixed in pypdf version 6.21.4.
A vulnerability in pdfly's pypdf component allows an attacker to craft a PDF that causes large memory usage when parsing the page tree with many shared resources. This can lead to resource exhaustion. The issue is fixed in pypdf version 6.21.4.
A vulnerability in pdfly's pypdf library allows an attacker to craft a PDF that causes an infinite loop when the file is incomplete and missing a trailer. This issue has been addressed in version 6.21.4 of pypdf.
Wireshark Release Candidate 5.0.0 was published on October 31, 2026, signaling the upcoming release of a new major version of the Wireshark network protocol analyzer. No specific security vulnerabilities or threats are described in this announcement.
YARA-X version 1.22.1 is a bugfix release that addresses two bugs. This release does not include the new built-in functions for reading 64-bit integers that are present in YARA 4.6.0. YARA-X has effectively replaced YARA as the tool for pattern matching and malware research.
YARA-X version 1.22.0 was released on October 25, 2026, introducing 11 improvements and 9 bug fixes. Among the enhancements is the addition of built-in functions to read 64-bit integers in various formats. There is no indication of security vulnerabilities or threats associated with this release.