A vulnerability in python-virtualenv versions from 21.14.9 up to but not including 21.14.13 allows an attacker to inject commands via the --prompt value in the bash bin/activate script. This occurs because the prompt value is copied into the PS1 environment variable without escaping dollar signs or backticks when promptvars and POSIX mode are disabled. Subsequent re-enabling of promptvars or POSIX mode can cause command substitution and execution under the activating user's privileges. The issue is fixed in version 21.14.13.
pypdf versions prior to 6.21.2 contain an incomplete fix for handling repeated malformed cross-reference entries in PDF files. This flaw can cause the library to repeatedly reload the entire PDF stream during recovery attempts, even when a recovery cache is available, leading to long runtimes when processing crafted PDFs. The issue has been resolved in version 6.21.2.
pypdf versions prior to 6.21.2 contain a vulnerability where an attacker can craft a PDF with a cross-reference table declaring more entries than the file actually contains. This causes excessive processing and long runtimes when the file is opened. The issue is fixed in version 6.21.2.
pypdf versions prior to 6.21.2 contain a vulnerability where a crafted PDF repeatedly references the same nonexistent indirect object. This causes repeated full-file recovery loads and long runtimes when accessing parts of the file such as pages. The issue is fixed in version 6.21.2.
A vulnerability in the Zephyr DNS stub resolver causes it to use a fixed UDP source port per configured server for DNS queries, violating RFC 5452 requirements. This allows an off-path attacker with UDP reachability to the device to predict the source port and attempt to spoof DNS responses by guessing only the 16-bit transaction ID. Successful spoofing can cause the application to resolve attacker-chosen addresses, potentially poisoning the DNS cache if enabled. The vulnerability is mitigated by a fix that randomizes the source port per query, increasing the guessing space.
The DHCPv4 client in Zephyr's network subsystem used a predictable transaction identifier (xid) for DHCP transactions, violating RFC 2131 requirements. This predictable xid allows an attacker on the same network segment or with prior knowledge of the xid to forge DHCP replies that the client accepts without verifying the server source. Such forged replies can redirect the device's network traffic by changing its default gateway and DNS resolvers, or disrupt network configuration by sending forged DHCPACK or DHCPNAK messages. The issue affects specific Zephyr versions and has a medium severity rating with a CVSS score of 5.6.
A vulnerability in the Zephyr RTIO streaming completion callback adxl345_process_fifo_samples_cb() causes out-of-bounds writes when the allocated buffer is smaller than a full FIFO batch. This leads to silent corruption of other RTIO consumers' data or potential crashes. Exploitation requires specific hardware with an interrupt-wired ADXL345 sensor and certain buffer pool conditions, with no network or external input vector.
CVE-2026-115775 is a high-severity vulnerability in the Twisted event-based framework for Python. The issue exists in the twisted.words.xish.domish ExpatElementStream parser prior to version 26.10.0rc1, where an unauthenticated remote peer can keep a container element open while continuously adding child elements. This causes the parser to retain the unfinished stanza as an in-memory tree without limits, potentially exhausting server memory and causing process termination. The vulnerability is fixed in version 26.10.0rc1.
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.
_language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.
A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.
ConnMan versions through 2.0 contain a stack-based buffer overflow vulnerability in the DHCPv6 Reply message processing. The flaw exists in the get_domains function in gdhcp/client.c, where a fixed-size buffer is overflowed by copying a large DOMAIN_LIST option without proper length checks. An unauthenticated on-link attacker can exploit this by sending a crafted Router Advertisement and DHCPv6 Reply, causing connmand (running as root) to crash.
CVE-2026-105483 is a high severity vulnerability affecting specific Ubuntu-packaged versions of Node.js. The vulnerability has a CVSS 3.0 score of 7.4, indicating a network attack vector with high impact on confidentiality and integrity but no impact on availability. The exact nature of the vulnerability is unknown as no detailed description is provided.
CVE-2026-105482 is a high severity vulnerability affecting specific Ubuntu-distributed versions of Node.js. The vulnerability has a CVSS 3.0 score of 7.4, indicating a network attack vector with high impact on confidentiality and integrity but requiring high attack complexity and no privileges or user interaction. The exact nature of the vulnerability is unknown as no detailed description or technical details are provided. No known exploits in the wild have been reported. The affected versions are specific Ubuntu package builds of Node.js versions 18.13.0, 18.19.1, and 20.19.4. No patch or remediation information is available, and the patch status is not confirmed.
CVE-2026-105481 is a medium severity vulnerability affecting specific Ubuntu-distributed versions of Node.js. The vulnerability has a CVSS 3.0 score of 6.5, indicating a network attack vector with high impact on integrity but low impact on confidentiality and availability. The exact nature of the vulnerability is unknown as no detailed description or technical details are provided. There are no known exploits in the wild, and no patch or remediation information is available from the provided data.
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: fix DMA mapping length for padded small packets
Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412
NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:
DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000
[fault reason 0x06] PTE Read access is not set
bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001
...
NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out
The fault address (0xfc499000) is on an exact 4KB page boundary,
pointing to a DMA read buffer overrun.
In bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),
such as 42-byte untagged ARP frames, are padded:
if (length < BNXT_MIN_PKT_SIZE) {
pad = BNXT_MIN_PKT_SIZE - length;
if (skb_pad(skb, pad))
goto tx_kick_pending;
length = BNXT_MIN_PKT_SIZE;
}
mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);
...
dma_unmap_len_set(tx_buf, len, len);
However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)
and is left unadjusted after padding. Consequently, dma_map_single() and
dma_unmap_len_set() map and track only 42 bytes.
Later, the hardware TX buffer descriptor is programmed with the padded length:
txbd->tx_bd_len_flags_type =
cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |
TX_BD_FLAGS_PACKET_END);
The NIC DMA engine is thus instructed to read 52 bytes from a region where
only 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB
page (within 'pad' bytes of the next page), the hardware DMA read overruns
into the unmapped adjacent page, triggering an IOMMU fault.
This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic
and races when toggling HW VLAN offload") because reserving extra VLAN
headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data
offsets and potentially causing small frames to land right against page
boundaries.
Fix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in
bnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled,
because padding might linearize the skb.
This ensures skb->len and skb_headlen(skb) reflect the padded size so
that dma_map_single() maps the full buffer and the descriptor length is
consistent. This also removes the temporary 'pad' variable and masking logic.
The padding is done after the SW USO branch, otherwise
bnxt_sw_udp_gso_xmit() would account the padding as UDP payload
and send it in extra segments.
Note that SW USO segments are still not padded: with IPv4, a segment
carrying less than 10 bytes of UDP payload (small gso_size, or a short
last segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.
This is a separate issue, left for a followup patch.
In the Linux kernel, the following vulnerability has been resolved:
cipso: adjust cached option offsets when removing CIPSO
cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust
cached offsets for options that follow them.
For example, with a valid 10-byte CIPSO option followed by a seven-byte
RR option, parsing records rr at offset 30. Removing CIPSO moves RR to
offset 20, while the cached offset remains 30. Consumers such as
ip_forward_options() and __ip_options_echo() then access the wrong bytes;
the latter may interpret packet data as the option length and copy it into
fixed-size option storage.
Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and
router_alert offsets when they follow CIPSO. cipso_len is the distance
the first memmove() shifts those options. The later header move and
network-header reset relocate the bytes and their offset base together.
Cacti versions from 1.2.27 up to but not including 1.2.31 contain an authenticated stored second-order SQL injection vulnerability in the automation tree rule item handler. A user with Automation realm privileges can inject arbitrary SQL fragments that are later executed when an administrator applies automation rules, leading to potential data exfiltration via the UI. This vulnerability has been fixed in version 1.2.31.
serialize-javascript versions from 7.0.1 before 7.1.3 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to break out of HTML script elements by injecting unescaped </script sequences in serialized function source text. Attackers who can control a function's source via a spoofed toString() method may inject live markup such as img onerror handlers, potentially leading to script execution in the context of the affected application.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy \{(.+)\} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.