AnyIO versions from 0.12.0_3 up to but not including 0.12.0_4 contain a vulnerability in the handling of the POSIX extra_groups argument in run_process() and open_process(). The open_process() function incorrectly forwards the extra_groups parameter, causing child processes to retain parent supplementary groups instead of properly clearing or setting them. This leads to a privilege-dropping correctness issue on POSIX systems, potentially affecting applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. The issue is fixed in version 0.12.0_4.
A vulnerability in aiohttp's CookieJar persistence causes host-only cookies saved to disk and later restored to lose their host-only attribute. This results in cookies being sent to subdomains that should not have received them, potentially exposing sensitive session data. The issue affects versions from 2026.4.30 up to but not including 2026.5.16_1. A patch is available in version 2026.5.16_1 to correct this behavior.
AnyIO's process-pool workers in the Torrra product do not properly drain stderr, causing a potential deadlock if too much data is written to stderr. This can block the worker process indefinitely, affecting users running untrusted or faulty code that writes extensively to stderr. The issue is fixed in version 2.1.0.
AnyIO's TLSStream uses IDNA 2003 encoding for internationalized domain names, which can enable TLS certificate spoofing. An attacker who hijacks and redirects a TLS connection to a malicious server can obtain a legitimate certificate for the IDNA 2003 encoded domain and present it to the client, causing the client to validate the malicious certificate. This vulnerability affects versions from 1.2.8 up to but not including 2.1.0 of the affected product. A patch is available in version 2.1.0, and a workaround involves manually encoding host names using the 'idna' package before connecting.
A vulnerability in Cockpit allows an unauthenticated remote attacker to cause a denial of service by initiating numerous simultaneous connections to the cockpit-tls service. This triggers unbounded thread creation, exhausting system resources and rendering the service unavailable to legitimate users. The issue is rated high severity with a CVSS score of 7.5. Red Hat has released an important security update addressing this flaw in Red Hat Enterprise Linux 9 and related variants.
The tailwindcss-contact-form npm package is a malicious package masquerading as the legitimate Tailwind CSS forms plugin. It contains heavily obfuscated code that, when imported, connects to public Ethereum RPC endpoints and a blockchain explorer API to retrieve a base64-encoded payload from transactions associated with a hardcoded Ethereum address. This payload is then executed on the host system, effectively enabling remote code execution controlled via the Ethereum blockchain. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately.
Multiple security vulnerabilities in ClamAV have been addressed in an update to version 1.5.4. These include improper boundary checks, invalid memory frees, integer overflows and underflows, out-of-bounds reads/writes, path traversal, and improper size handling in various parsers and unpackers. The update also fixes thread-safety issues, memory leaks, and improves quarantine handling on FreeBSD. These vulnerabilities could lead to crashes, memory corruption, excessive resource allocation, and unauthorized file access.
A security update for the GNU C Library (glibc) addresses a heap buffer overflow vulnerability in the scanf function when using the %mc format specifier with a large width. This flaw could affect the stability and security of Linux systems relying on glibc for standard C libraries and related functions.
CVE-2026-69522 is a high severity remote code execution vulnerability in Microsoft.DiaSymReader.Native affecting Windows platforms. It involves an out-of-bounds write when processing PDB files, leading to a heap-based buffer overflow (CWE-122). The flaw impacts multiple .NET versions and Visual Studio components. A patch is available in version 18.9.0-beta1.26405.2 and the September 2026 .NET Framework security update. Users should update to these versions and restart applications to mitigate the risk.
A security update for the SUSE Linux Enterprise Micro 6.0 and 6.1 kernels addresses multiple security vulnerabilities across various kernel subsystems including networking, timers, SCSI, SMB client, netfilter, BPF, and others. These fixes resolve issues such as memory leaks, use-after-free, NULL pointer dereferences, race conditions, and validation errors. The update mitigates a broad range of potential kernel-level security risks.
A security update for libpng16 addresses multiple issues by updating the version to 1.6.58. The update is provided by the SUSE Product Security Team. No specific details about the vulnerabilities or affected versions are given.
A vulnerability in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform allows a compromised Windows worker node to escalate privileges. The flaw involves the WICD CSR auto-approver accepting additional organization values in certificate signing requests, enabling an attacker with WICD credentials to obtain cluster-administrator privileges. This affects OpenShift clusters running WMCO with Windows nodes. No mitigation or workaround is currently available, and a fix is expected in future updates.
Multiple security vulnerabilities have been fixed in libssh2_org, including out-of-bounds heap reads, integer overflows, heap buffer overflows, uninitialized pointer frees, arbitrary code execution, denial of service, and information disclosure. These issues affect various functions such as sftp_symlink(), userauth_password(), and SSH negotiation. The update also includes other bug fixes related to Encrypt-then-MAC and key exchange method configurations.