Live Threat Intelligence Radar

CVE-2026-111823 is a critical vulnerability in Mage OSS mage-ai versions up to 0.9.80. The issue involves the software proceeding with session creation even when encountering an unknown OAuth provider, which is a detection of error condition without action (CWE-390). This flaw can lead to complete compromise of confidentiality, integrity, and availability as indicated by its CVSS 3.1 score of 9.8.

CVE-2026-89096 is a vulnerability in the nfs-utils package on Red Hat Enterprise Linux 10. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending repeated state notification requests to the rpc.statd service. The flaw causes the service to fail to release allocated memory properly, leading to continuous memory growth and eventual resource exhaustion. This can degrade or crash the rpc.statd service, impacting system availability.

CVE-2026-89088 is a heap-based buffer overflow vulnerability in libparted's file system resizing logic for FAT16 volumes on Red Hat Enterprise Linux 10. It occurs when resizing a specially crafted FAT16 file system image with malformed directory metadata, leading to memory corruption and application crash, causing denial of service. The vulnerability requires user interaction and local access to trigger.

A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.

The OSSTMM 4 pre-release was announced and streamed live at the ICIST Conference in Lithuania, with a public release planned for December 1, 2026. OSSTMM (Open Source Security Testing Methodology Manual) is a framework for security testing and analysis. This announcement is informational and does not describe a specific security vulnerability or threat.

Text::CSV_XS versions before 1.65 for Perl have an issue where parsing input that ends with a separator followed by a lone carriage return (CR) results in the parser inserting a 0xFF byte into the last field. This byte is not present in the original input and can lead to malformed UTF-8 strings when UTF-8 flagging is enabled. This occurs specifically when the last field is empty and the input ends with CR instead of CRLF. The issue causes the parser to treat the end-of-file marker as data, which may affect applications processing CSV data line by line.

Text::CSV_XS versions before 1.65 for Perl contain a buffer under-read vulnerability in the strip_trail_whitespace function when allow_whitespace is enabled. This occurs because the function reads bytes before the start of an all-blank field's buffer, potentially accessing memory outside the intended bounds. The issue arises specifically with fields consisting only of blanks under certain parsing conditions involving escape characters or quoted fields ending with two carriage returns.

Text::CSV_XS versions before 1.65 for Perl have a vulnerability where numeric fields that contain leading or trailing whitespace and newline characters can be written without quotes during CSV record combining. This improper encoding allows a numeric value with a newline to prematurely terminate a CSV record, causing subsequent fields to be interpreted as a new record.

Text::CSV_XS versions before 1.65 for Perl improperly handle UTF-8 flagged fields containing invalid UTF-8 bytes during print operations. This causes the end of a record, including its closing quote and line ending, to be dropped, resulting in subsequent records being concatenated onto the same line or misinterpreted as part of the previous field.

Text::CSV_XS versions before 1.65 for Perl contain an inefficient algorithmic complexity vulnerability (CWE-407) that causes quadratic CPU usage when processing CSV input with carriage return (CR)-only line endings. This occurs because the getline function copies the entire unparsed remainder of the input buffer after each record, leading to performance degradation proportional to the square of the input size. This can cause significant CPU consumption when parsing large CSV files with classic Mac line endings.