Live threat intelligence radar

### Summary The Secure attribute was not being enforced for the shared cookie. ### Impact It may be possible to send a shared cookie marked Secure through an unencrypted request.

### Summary The `handle_short_request()` function in `urwid/display/web.py` raises an unhandled `UnicodeEncodeError` when processing a POST request body containing non-ASCII bytes. The function reads POST input and encodes it to ASCII before writing to a named pipe. Any byte value above `0x7F` causes the CGI process to exit with an unhandled exception, returning an HTTP 500 error to the client. Additionally, a file descriptor opened earlier in the same function is not closed before the exception propagates, causing a file descriptor leak for the lifetime of the CGI process. A second instance of missing exception handling exists in the polling update path, where non-UTF-8 socket output causes an unhandled `UnicodeDecodeError`. ### Impact An attacker who observes a valid `X-Urwid-ID` session token (transmitted in plaintext HTTP response headers) can send repeated POST requests containing non-ASCII bytes to the `urwid` CGI endpoint. Each malformed request causes the CGI handler to crash with HTTP 500. This results in a Denial of Service (DoS) for legitimate users using the `urwid` web interface. ### Affected Versions `urwid <= 4.0.6` ### Patches Fixed in `urwid 4.0.7`. Users should upgrade to version `4.0.7` or later. ### Workarounds No direct workaround exists short of disabling the `urwid` web display interface.

A critical remote code execution vulnerability exists in React Server Components affecting react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0. The flaw can be exploited via crafted payloads involving multiple typed arrays and attacker-controlled values. Fixed versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1 have been released and immediate upgrading is recommended. Applications not using React Server Components or the affected frameworks are not impacted.

Multiple authorization bypass vulnerabilities (CVE-2026-20183, CVE-2026-20285, CVE-2026-20286) affect Cisco Identity Services Engine (ISE) products. These vulnerabilities impact Cisco ISE and Cisco ISE-PIC regardless of device configuration. Specific affected versions include Cisco ISE 3.1 and 3.1.0. Detailed fixed software versions are referenced in the vendor advisory but not provided here.

A path traversal vulnerability (CVE-2026-79655) exists in the sos package used in Red Hat Enterprise Linux 9. This flaw occurs during tar extraction in the sos clean process due to unvalidated symlink and hardlink targets, allowing arbitrary file writes. Red Hat has released an update that fixes this issue in sos version 4.11.2-7.el9_9. The vulnerability is rated as important by Red Hat Product Security.

Multiple security vulnerabilities have been identified in libreswan, an implementation of IPsec and IKE for Linux used to build secure VPN tunnels. The issues include an IKEv2 Use-After-Free bug when using IKE-over-TCP, a pre-authentication null pointer dereference in the EAP code, and a null pointer dereference in the PKCS#7 bundle with no certificates. These vulnerabilities have been rated as important by Red Hat and affect Red Hat Enterprise Linux 9. An update is available to address these issues.