Axios versions prior to 1.15.1 and 0.31.1 contain a prototype pollution vulnerability in the HTTP adapter that allows attackers to inject arbitrary HTTP headers into outgoing requests. This occurs because Axios misidentifies plain object payloads as FormData instances when Object.prototype is polluted with certain functions, leading to execution of attacker-controlled header injection. The vulnerability is fixed in versions 1.15.1 and 0.31.1.
Axios versions prior to 1.15.1 and 0.31.1 are vulnerable to prototype pollution when Object.prototype is polluted by another co-dependency. This vulnerability allows an attacker to intercept and modify JSON responses or hijack HTTP transport, exposing sensitive request data. The flaw is fixed in versions 1.15.1 and 0.31.1.
A buffer over-read vulnerability exists in rust-openssl versions from 0.9.24 up to but not including 0.10.78. The issue arises because certain FFI trampolines forward a user closure's returned usize directly to OpenSSL without validating it against the provided buffer size, potentially causing buffer overflows and unintended behavior. This vulnerability is fixed in version 0.10.78.
A stack-based buffer overflow vulnerability exists in rust-openssl versions from 0.10.39 up to but not including 0.10.78. The issue occurs because EVP_DigestFinal() writes EVP_MD_CTX_size(ctx) bytes to the output buffer without verifying if the buffer is large enough, leading to potential stack corruption. This vulnerability is reachable from safe Rust code and has been fixed in version 0.10.78.
CVE-2026-41678 is a high-severity out-of-bounds write vulnerability in rust-openssl versions from 0.10.24 up to but not including 0.10.78. The aes::unwrap_key() function contains an incorrect assertion that improperly validates buffer sizes, leading to potential memory corruption when a smaller output buffer is provided. This flaw is fixed in version 0.10.78.
A low-severity out-of-bounds read vulnerability exists in rust-openssl versions from 0.9.0 up to but not including 0.10.78. The issue arises because the *_from_pem_callback APIs do not validate the length returned by a user-supplied password callback, potentially causing OpenSSL versions prior to 3.x to over-read buffers. This vulnerability is fixed in rust-openssl version 0.10.78.
A heap/stack out-of-bounds write vulnerability exists in rust-openssl versions from 0.9.27 up to but not including 0.10.78. The issue arises because Deriver::derive and PkeyCtxRef::derive pass a buffer length to OpenSSL 1.1.x that is ignored by certain cryptographic operations (X25519, X448, DH, HKDF-extract), causing an overflow when a short slice is provided. This flaw does not affect OpenSSL 3.x. The vulnerability is fixed in rust-openssl version 0.10.78.
CVE-2026-41411 is a command injection vulnerability in Vim prior to version 9.2.0357. The flaw exists in Vim's tag file processing where the filename field is passed through wildcard expansion, allowing execution of embedded commands via backtick syntax with the privileges of the running user.
A vulnerability in the lxml Python library prior to version 6.1.0 allows untrusted XML input to read local files when using the default parser configuration with resolve_entities=True. This improper restriction of XML external entity references (CWE-611) can lead to local file disclosure. The issue is fixed in version 6.1.0 by changing the default behavior or allowing explicit configuration to disable external entity resolution.
A vulnerability in the Linux kernel's NFC driver for the PN533 chip involves improper handling of receive buffers. The issue occurs because the driver may consume bytes into a receive buffer before allocating a new buffer, leading to a NULL pointer dereference if buffer allocation fails. This flaw has been fixed by changing the allocation timing to occur before consuming bytes.
A memory leak vulnerability in the Linux kernel's __mmap_region() function was fixed. The flaw occurs when mmap'ing /dev/zero with MAP_SHARED, where a replacement file allocated for the mapping is not properly released on error paths, leading to a memory leak. This issue was identified and corrected by adding a missing fput() call to release the swapped file in error scenarios.
A memory leak vulnerability in the Linux kernel's mm/damon/sysfs component occurs when damon_call() fails to deallocate repeat_call_control. This can happen if the monitoring daemon (kdamond) stops before damon_call() is invoked, such as when monitoring virtual address processes that terminate immediately. The issue has been fixed by ensuring repeat_call_control is deallocated upon damon_call() failure.
A memory leak vulnerability exists in the Linux kernel's mm/damon/stat component due to improper deallocation of the damon_ctx object when damon_call() fails. This leak occurs because the kernel defers deallocation to avoid use-after-free errors with the kdamond main function. The issue was fixed by modifying damon_stat_start() to handle deallocation safely, returning -EAGAIN if kdamond is still running and deallocating only once kdamond has terminated.
A vulnerability in the Linux kernel's lan966x network driver was fixed by correcting error handling in the lan966x_fdma_rx_alloc_page_pool() function. The issue involved improper handling of error pointers returned by page_pool_create(), which could lead to a kernel oops (crash) due to dereferencing an invalid pointer.
CVE-2026-31644 is a use-after-free and memory leak vulnerability in the lan966x network driver of the Linux kernel. It occurs when lan966x_fdma_reload() fails to allocate new RX buffers and incorrectly restarts DMA with freed memory pages, potentially allowing hardware DMA into memory owned by other kernel subsystems. The flaw also causes a leak of a partially allocated page pool. The issue has been fixed by deferring the release of old pages until new allocations succeed and ensuring proper cleanup and restore operations.
A memory leak vulnerability was identified and fixed in the Linux kernel's rxrpc component. The issue involved memory attached to token->rxgk being leaked in certain error paths during key parsing. The fix ensures proper freeing of this memory in the error handling case.
CVE-2026-31641 is a heap buffer overflow vulnerability in the Linux kernel's rxrpc subsystem caused by improper bounds checking of RxGK token lengths. An unprivileged local user can exploit this flaw by providing specially crafted key and ticket lengths that trigger an integer overflow during memory allocation, leading to a heap overflow. This can result in arbitrary code execution or denial of service. The vulnerability has been fixed by validating length values before rounding and allocation, and by caching lengths to prevent time-of-check to time-of-use issues. Mitigation includes blacklisting the rxrpc kernel module, which may affect applications relying on this protocol.
A vulnerability in the Linux kernel's rxrpc subsystem was fixed where the code incorrectly compared the challenge serial number from a newer packet instead of the cached older response. This flaw caused the comparison to always fail, potentially leading to improper handling of response packets. The fix involves correcting the comparison to use the older packet and properly substituting the newer packet when appropriate.
CVE-2026-31636 is a critical vulnerability in the Linux kernel's rxrpc subsystem involving an out-of-bounds (OOB) read in the RESPONSE authenticator parser. The flaw arises because the parser limit calculation incorrectly inflates the pointer by a factor of four, allowing malformed RESPONSE authenticators to read beyond the allocated buffer. This issue was detected by Kernel Address Sanitizer (KASAN) and leads to a slab-out-of-bounds error in rxgk_verify_response().
CVE-2026-31635 is a vulnerability in the Linux kernel's rxrpc subsystem where an incorrect check allows oversized RESPONSE authenticators to be accepted. This flaw can lead to a kernel BUG_ON() due to an impossible length passed to skb_to_sgvec(), causing a denial of service (system crash). The issue arises from an inverted length check in rxgk_verify_response().