A heap out-of-bounds write vulnerability exists in the mutt email client in the convert_file_from_to() function when processing a crafted Content-Type header. This flaw allows an attacker to perform an out-of-bounds write if the email is used as a template. The vulnerability is rated medium severity with a CVSS score of 2.5.
CVE-2026-107161 is a heap-based buffer overflow vulnerability in the Cyrus SASL DIGEST-MD5 plugin. The flaw arises because the add_to_challenge() function miscalculates buffer size before quoting special characters, leading to an undersized buffer and an out-of-bounds write. This can cause the client application to crash when processing a crafted challenge field from a malicious or on-path DIGEST-MD5 or HTTP Digest server. The vulnerability has a CVSS score of 7.5, indicating high severity.
A missing authorization vulnerability in the Network component of Google Chrome versions prior to 155.0.8059.39 allows a remote attacker to bypass the web origin policy via crafted network traffic, leveraging social engineering. The vulnerability has a medium severity rating with a CVSS score of 6.5 and impacts the integrity of the browser. No affected versions are explicitly stated beyond the version prior to 155.0.8059.39. No patch or remediation information is provided in the available data.
A vulnerability in Google Chrome on iOS versions prior to 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This issue is due to incorrect authorization in the password management component. The vulnerability has a medium severity rating.
A race condition vulnerability exists in the Chromoting component of Google Chrome versions prior to 155.0.8059.39. This flaw could allow a remote attacker, using social engineering and crafted network traffic, to potentially bypass system access restrictions. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A missing authorization vulnerability in the Animation component of Google Chrome versions prior to 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability has a medium severity rating and could lead to unauthorized actions without compromising confidentiality or availability.
A missing authorization vulnerability in DevTools of Google Chrome versions prior to 155.0.8059.39 allows a remote attacker to bypass the web origin policy by leveraging social engineering through a crafted Chrome extension. The vulnerability has a medium severity rating with a CVSS score of 6.5. No known exploits are reported in the wild. No explicit patch information is provided in the input data.
A vulnerability in Google Chrome Extensions prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via crafted extensions using social engineering. This improper input validation flaw could lead to privilege escalation to a privileged page. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A vulnerability in the scheduling component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy by using a crafted HTML page. The issue is related to incorrect authorization checks. The vulnerability has a low security severity rating from Chromium and a CVSS score of 4.3, indicating a medium severity level overall.
A missing authorization vulnerability in the Network component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. The vulnerability has a medium severity rating.
A confused deputy vulnerability in the Omnibox component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via crafted network traffic. This vulnerability has a medium severity rating and impacts the integrity of web content handling.
An incomplete cleanup vulnerability in the Chromoting component of Google Chrome on Mac versions prior to 155.0.8059.39 allows a remote attacker to bypass system access restrictions via crafted network traffic. The vulnerability has a high CVSS score of 9.1, indicating critical severity. It does not require user interaction or privileges to exploit. No explicit patch information is provided in the input data.
A security update for rsyslog addresses a vulnerability in the imdtls module that allowed bypassing permitted-peer authorization. This issue could potentially allow unauthorized peers to connect despite authorization controls. The update fixes this authorization bypass to enhance security.
GitPython versions before 3.1.62 contain a path traversal vulnerability in the handling of the .gitmodules 'path' field during submodule updates. The update() method does not properly validate the 'path' field, allowing directory traversal components to cause file operations outside the intended repository directory. Exploitation requires specifying a non-HEAD commit, which limits common usage impact. A fix is available that applies proper containment validation to the 'path' field.
A denial-of-service (DoS) vulnerability exists in containerd version 3.0 and several other specific versions. The issue is triggered by a crafted OCI index graph amplification during the image-pull process, which can cause resource exhaustion. This vulnerability is identified as CVE-2026-53493 and is classified with medium severity.
CVE-2026-102422 is a vulnerability in the node-shell-quote package where the quote() function emits a comment token that can comment out the rest of a shell line. This vulnerability is associated with CWE-78 and has a CVSS score of 8.1, indicating high severity. The affected versions are 1.6.1+20160617-git72fb5a8ce29b-1 and 1.10.0-1. The Red Hat advisory references this CVE but does not explicitly state patch availability or remediation details for node-shell-quote. The advisory mainly discusses updates to prometheus3.13 packages. No known exploits are reported in the wild.
GitPython version 3.1.59 contains a vulnerability (CVE-2026-87817) where the library incorrectly resolves the git directory path by testing certain tracked files before the actual .git directory. This allows an attacker controlling a repository to craft files that impersonate the git directory, causing GitPython to treat attacker-controlled content as internal git data, including executable hooks. This leads to arbitrary code execution when the victim performs a commit via GitPython's index.commit() method. Additional impacts include unauthorized reading of files outside the repository and writing config files to attacker-chosen locations. The vulnerability affects services that open or clone untrusted repositories using GitPython. A patch is available to correct the directory resolution order and improve validation.
GitPython's Actor.name_email_regex regular expression is vulnerable to catastrophic backtracking (ReDoS) when parsing commit author or committer fields containing a long string with an unterminated '<'. This causes quadratic CPU exhaustion, leading to denial of service. The vulnerability affects GitPython versions from 1.11.0 up to but not including 1.50.0. A crafted commit object can cause API calls accessing author or committer metadata to hang for over two minutes. This impacts CI runners, code-hosting backends, and repository scanning tools that process untrusted commits. A fix is available.
This Red Hat security advisory addresses multiple vulnerabilities in the BIND DNS software included in Red Hat Hardened Images RPMs. The update fixes issues such as unauthenticated application of IXFR deltas before TSIG verification, use-after-free crashes in recursive resolvers, remote assertion failures, and denial of service via cached AliasMode trees. These vulnerabilities could lead to crashes, data leakage, or denial of service conditions. The update is provided in bind version 9.20.29-0.1.hum1 for aarch64 and x86_64 architectures. The severity is assessed as high due to the potential impact on DNS resolution.
A memory leak vulnerability exists in aiohttp when middleware is enabled and a request triggers a MatchInfoError due to a non-allowed HTTP method. This occurs because each MatchInfoError creates a unique cache entry, causing unbounded memory growth. An attacker could exploit this by sending large volumes of such requests, potentially exhausting server memory. A patch is available to address this issue.