CVE-2026-97037 is a code injection vulnerability in the Go toolchain's cmd/go component. It arises when building a malicious package that uses cgo, allowing arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". The vulnerability involves improper handling of certain "-Wl," flags that could be interpreted as linker scripts, leading to potential code execution. The issue is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97038 is a code injection vulnerability in the Go toolchain's cmd/go component. It allows building a malicious package with specially crafted ".syso" files or cgo linker inputs that can inject arbitrary linker flags or execute code during the linking phase. The vulnerability arises because linker input files were passed to the external linker without proper validation, enabling execution of disguised linker scripts or injection of unallowlisted linker flags across multiple platforms. The issue is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97039 is an argument injection vulnerability in the Go toolchain's cmd/go component. It involves malicious packages using "#cgo pkg-config:" directives to load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The vulnerability arises from overly permissive allowlists for certain pkg-config flags and insufficient validation of flags returned by "pkg-config --cflags". The issue is addressed by disallowing specific flags and inspecting cgoCPPFLAGS for internal linking safety.
CVE-2026-97040 is a code injection vulnerability in the Go toolchain's cmd/go component. It allows an attacker to craft a ".syso" file that bypasses cgo flag validation and injects arbitrary linker flags during the linking process. This occurs because the linker incorrectly parses certain ".syso" files as Go compiler objects, allowing untrusted cgo metadata directives to be passed to the external linker without validation. The issue also involves improper handling of long ".syso" filenames, which can lose their extension and force external linking in pure-Go builds. The vulnerability is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97041 is an argument injection vulnerability in the Go toolchain's cmd/compile component. Malicious packages using certain //go:cgo_* compiler directives could inject arbitrary flags into the external linker on ELF platforms. This was due to the compiler and linker not rejecting commas in specific cgo directives, allowing crafted inputs to split linker flags and inject unintended arguments. The vulnerability also allowed overwriting of external symbol names via the two-argument form of //go:cgo_import_dynamic. The issue is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97042 is an argument injection vulnerability in the Go toolchain's cmd/cgo component affecting Windows. It allows unsafe library arguments to be passed to the external linker via malicious use of "//go:cgo_import_dynamic" directives or crafted PE object files. The issue arises from insufficient validation of library names, enabling path traversal and special character injection. The vulnerability is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97043 is an argument injection vulnerability in the Go toolchain's cmd/go component. It allows a malicious package using cgo to bypass validation of "#cgo LDFLAGS" directives, potentially causing unexpected code execution during build or causing the go command to panic. The issue arises from inconsistent handling of quoted linker flags between cmd/cgo and cmd/compile/cmd/go. The vulnerability is fixed in Go versions 1.26.11 and 1.27.4.
Two security vulnerabilities affecting the acl package in Red Hat Enterprise Linux 7 Extended Lifecycle Support allow symlink traversal attacks. These include a privilege escalation via libacl functions (CVE-2026-54369) and a time-of-check to time-of-use (TOCTOU) symlink traversal via the getfacl/setfacl utilities (CVE-2026-54370). These flaws could allow unauthorized privilege escalation through improper handling of symbolic links.
Multiple security vulnerabilities have been identified in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. These include arbitrary code execution due to missing symlink protection, arbitrary write access as root via extra-data extraction, a buffer overflow in OCI delta stream path names on 32-bit systems, and local privilege escalation via symlink traversal in the revokefs writer. Red Hat has issued an important security update addressing these issues in Flatpak for Red Hat Enterprise Linux 8.8 variants.
Red Hat has issued a security advisory for Node.js 24 module in Red Hat Enterprise Linux 8, addressing multiple vulnerabilities across several components including brace-expansion, undici, and sqlite. The issues include denial of service via uncontrolled recursion and stack exhaustion, denial of service via unhandled stream errors and TLS renegotiation, certificate validation bypass, heap-based buffer overflow, and arbitrary code execution via crafted session changesets and corrupted indexes. These vulnerabilities have been rated with an important security impact by Red Hat.
This Red Hat Security Advisory addresses multiple security vulnerabilities in Mozilla Firefox, including denial of service, mitigation bypasses, spoofing, privilege escalation, use-after-free, information disclosure, sandbox escapes, race conditions, integer overflows, and incorrect boundary conditions across various Firefox components. The update also includes bug fixes and enhancements for Firefox ESR 153 rebase on Red Hat Enterprise Linux 9.4. The advisory rates the security impact as Important and provides fixes for these issues.
A security vulnerability (CVE-2026-10846) in the ldns library used for DNS programming in C allows off-path poisoning attacks due to insufficient query-response matching. This vulnerability affects ldns packages in Red Hat Enterprise Linux 8.8 variants. Red Hat has issued an important security update to address this issue.
Movable Type software by Six Apart Ltd. has a code injection vulnerability in its Dynamic Publishing functionality. No specific affected versions or exploit details are provided.
Red Hat OpenShift Container Platform 4.13.73 includes updates that address multiple security vulnerabilities, including arbitrary code execution via cross-site scripting, denial of service via malformed HTTP/2 frames, privilege escalation through incorrect Punycode processing, and man-in-the-middle attacks via untrusted intermediate certificates. The advisory rates the security impact as Important and recommends upgrading to the updated packages and images when available.
Multiple denial of service vulnerabilities have been identified in the Tornado Python web framework, affecting the python-tornado package in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. These vulnerabilities include uncontrolled gzip decompression memory consumption, excessive URL-encoded body fields, memory amplification in multipart parsing, and decompression bomb in CurlAsyncHTTPClient. Red Hat has released security updates to address these issues.
LimeSurvey Community Edition 7.8.0 has an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can craft a .lsa archive with a participant XML that creates an attacker-named attribute column. When exporting responses from the imported survey, the application improperly treats names containing parentheses as SQL expressions, leading to execution of attacker-controlled SQL with database privileges.
CVE-2026-63660 is an integer overflow vulnerability in the mapbox node-fontnik library before version 0.7.7. It occurs in the RenderSDF function where the allocation size for an SDF bitmap is calculated using 32-bit unsigned integers without upper bounds on glyph dimensions. A specially crafted font can cause the multiplication to overflow, resulting in a heap out-of-bounds write and process crash. This flaw has been fixed in version 0.7.7.
Padloc versions 4.0.0 through before 4.3.1 have an authentication bypass vulnerability due to improper restriction of excessive authentication attempts in the legacy retrieveMFAToken handler. This flaw allows unauthenticated attackers who know a victim's email to brute force 6-digit email verification codes without these attempts counting toward the limit, enabling them to obtain verification tokens usable in signup, login, and account recovery processes.
Padloc versions 4.0.0 through 4.3.0 contain a prototype pollution vulnerability that allows SCIM token holders to modify the Object.prototype. This occurs via crafted SCIM PATCH requests to the ScimServer._handleScimUsersPatch() function, enabling attackers to inject properties into the shared server process and disrupt requests for all organizations. The vulnerability is fixed in version 4.3.1.