Search: 18.8.3.2

A critical SQL injection vulnerability (CVE-2026-114625) in Arista Networks' VeloCloud Orchestrator (VCO) allows remote attackers with authenticated access to escalate privileges to operator level and access internal functionality not intended for remote use. The flaw affects on-premises VCO versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista has patched the vulnerability and already mitigated hosted deployments. Attackers have actively exploited this zero-day, and administrators are urged to update immediately and monitor for suspicious activity.

CVE-2026-113721 is a vulnerability in virtualenv where generated activation files and pyvenv.cfg can follow existing symbolic links and write outside the intended environment. This occurs because the code checks for file existence without handling dangling symlinks properly, allowing writes to unintended targets if an attacker can prepare links in the destination. The vulnerability requires attacker-controlled links and write permissions on the linked targets. It was fixed in versions 1.6.2 and 1.18.1_2.

CVE-2026-90458 is a medium severity vulnerability affecting multiple specific versions of the Ironic software package distributed in Ubuntu. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a network attack vector with low complexity and requiring low privileges, resulting in limited confidentiality and integrity impacts without availability impact. No detailed description of the flaw or exploitation method is provided. There are no known exploits in the wild and no vendor patch or remediation information is available in the provided data.

CVE-2026-89419 is a medium severity vulnerability affecting multiple specific Ubuntu package versions of the Ironic project. The vulnerability has a CVSS 3.1 base score of 5.0, indicating a network attack vector with high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No detailed description of the flaw or exploitation method is provided. There are no known exploits in the wild, and no patch or remediation information is available in the provided data.

FreeRDP versions before 3.32.1 on Windows contain a heap out-of-bounds read vulnerability. This flaw can lead to information disclosure and a denial of service condition. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. The issue is addressed by updating Brotli libraries or binaries to versions 1.0.9-2ubuntu0.1, 1.1.0-2ubuntu0.1, 1.2.0-4ubuntu0.1, or later. Ubuntu has released security updates for multiple supported releases to fix this vulnerability.

A vulnerability in Python 2.7's tarfile module allows crafted tar archives with specially crafted link entries, including symlinks with empty or directory-like names, to bypass the tar_filter protection. This can cause tarfile.extractall() with filter="tar" to write files outside the intended extraction directory, potentially leading to unauthorized file writes depending on the extracting process's permissions. This issue is related to CVE-2026-7774, which affected tarfile.data_filter.

Mistune versions before 3.3.0 have a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by using ../ sequences in include paths. Additionally, attackers can inject HTML through unescaped error messages and included file contents, enabling cross-site scripting (XSS) even when escape=True is set. This vulnerability has a high severity with a CVSS score of 7.5.

Mistune versions before 3.3.0 have a path traversal vulnerability in the optional Include directive. This flaw allows attackers to read arbitrary local files by providing relative or absolute paths during Markdown rendering. Exploitation can lead to disclosure of sensitive files such as /etc/passwd and injection of unescaped HTML or script content into the rendered output.

Mistune versions before 3.3.0 have a path traversal vulnerability in the RST include directive. This flaw allows attackers to craft markdown with include directives that reference relative or absolute paths, enabling them to read arbitrary files. Sensitive files such as credentials or environment data can be exposed in the rendered HTML output. The vulnerability has a high severity with a CVSS score of 8.6.

Mistune versions before 3.3.0 have an algorithmic complexity vulnerability in the inline link parser. This flaw allows unauthenticated attackers to exhaust CPU resources by submitting markdown inputs with long sequences of unmatched '[' characters. The vulnerability causes the parser to perform O(N^2) operations, significantly delaying rendering and occupying worker threads for extended periods.

Mistune versions from 3.2.1 up to but not including 3.3.0 contain a CSS injection vulnerability. This flaw allows attackers who can control markdown input to inject arbitrary CSS style declarations via the unvalidated figwidth option of the figure directive. Exploitation can cause victim browsers to send requests to attacker-controlled servers, potentially leaking attribute values. The vulnerability has a medium severity rating with a CVSS score of 4.7.

Mistune versions before 3.3.0 have a cross-site scripting (XSS) vulnerability in the Include directive. This flaw occurs because included .html, .xhtml, or .htm files are emitted as raw HTML tokens without proper escaping. An attacker who can place a readable HTML file on the system and leverage path traversal can cause stored scripts to execute if escape=False is set in the renderer.

Mistune versions from 3.0.0 up to but not including 3.3.0 contain an algorithmic complexity denial of service (DoS) vulnerability in the parse_link_text function. This flaw allows attackers to craft markdown input with deeply nested square brackets that cause quadratic parsing time, leading to excessive CPU consumption and potential service disruption.

Mistune versions from 3.0.0 up to but not including 3.3.0 contain an algorithmic complexity vulnerability in the inline link parser's parse_link_text function. This flaw allows unauthenticated attackers to cause high CPU usage by submitting Markdown with many unbalanced '[' or '![' characters, resulting in repeated unbounded forward scans that can tie up worker processes for minutes. The vulnerability has a high severity with a CVSS score of 7.5.

Mistune versions before 3.3.0 have an inefficient algorithmic complexity vulnerability in the parse_link_text function. This flaw allows remote attackers to cause denial of service by submitting markdown with long runs of unmatched square brackets. The vulnerability triggers repeated forward scans in mistune.html(), stalling worker processes for extended periods.

Arista Networks patched a critical zero-day vulnerability (CVE-2026-114625) in VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw allows authenticated users with basic privileges to escalate to operator-level privileges via low-complexity SQL injection attacks without user interaction. This enables access to internal functionality not intended for remote access, potentially compromising the confidentiality, integrity, and availability of the orchestrator and managed data. Hosted VCO deployments running versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later have been patched. Until patches are applied, Arista recommends restricting VCO web interface access, monitoring for suspicious activity, and blocking known malicious IP addresses involved in ongoing attacks.

EDK2 BIOS firmware contains a critical vulnerability that allows remote attackers to cause out-of-bounds writes, classic buffer overflows, and incorrect buffer size calculations. Successful exploitation can lead to arbitrary code execution, impacting confidentiality, integrity, and availability of affected systems. Multiple specific versions of EDK2 are affected.

Multiple security vulnerabilities have been identified in CUPS, the open source printing system used on UNIX-like operating systems. These include an arbitrary file write due to predictable temporary file handling, command injection via email notification recipient arguments, several denial-of-service conditions caused by null pointer dereferences and double-free errors, and a resource exhaustion vulnerability. These issues affect CUPS versions prior to 2.4.7-18.oe2403sp1 and have a medium severity rating. A patch is available to address these vulnerabilities.

A vulnerability in webpack-dev-server versions from 5.1.0 before 5.2.7 and version 6.0.0 allows unauthenticated attackers to trigger an exception via a specially crafted Host header to the open-editor endpoint. This causes the server to return an HTTP 500 error with a full exception stack trace that discloses sensitive information such as absolute filesystem paths and internal source line numbers. The server remains operational after the error. The issue is fixed in versions 5.2.7 and 6.1.0.