The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer.
The OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_command_decode() accepts the Calculate Checksum op code unconditionally (it is not guarded by CONFIG_BT_OTS_OACP_CHECKSUM_SUPPORT), builds without checksum support are reachable too: they answer BT_GATT_OTS_OACP_RES_OPCODE_NOT_SUP and take the same bad path.
On builds with CONFIG_ASSERT enabled, the zero-length pull trips the assertion inside net_buf_simple_pull_mem() and panics the device, giving a remotely triggered denial of service. On builds with assertions disabled there is no check: the pull returns the untouched stack array and four bytes of uninitialized stack memory are copied into the indication and transmitted to the peer, repeatable on every request. The disclosure is bounded to four bytes per request and the write stays inside the seven-byte res indication buffer, so there is no memory corruption; the impact is uninitialized-memory disclosure plus an availability loss in assertion-enabled configurations.
Dolibarr ERP CRM versions prior to 24.0.0 contain an OS command injection vulnerability in the htdocs/admin/tools/export.php file. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting a specially crafted mysqldump value that chains commands using & characters. Exploitation enables execution of arbitrary operating system commands with the privileges of the web server user.
CVE-2026-93849 is a vulnerability in Mattermost versions 11.7.0 through 11.7.10, 11.8.0 through 11.8.5, 11.9.0 through 11.9.1, and 11.10.0 through 11.10.1. The issue arises from a failure to apply allocation limits in the WebSocket msgpack decoder's byte-string decode paths. This allows an authenticated remote attacker to cause excessive server memory allocation by sending a crafted binary WebSocket frame with a Bin32 payload length up to 4,294,967,295 bytes. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, and impacts availability without affecting confidentiality or integrity.
A vulnerability in the HTTP/2 implementation of the bandit server allows unauthenticated remote attackers to exhaust server memory by sending a small HPACK-compressed HEADERS block that references a large cookie value many times. This causes excessive memory allocation before application code runs, potentially leading to denial of service. The issue affects bandit versions from 0.3.3 up to but not including 1.14.0.
Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D (decoding to [::ffff:127.0.0.1]) or 127.0.0.1. is not an IP address to a caller's allowlist built on uri_string:parse/1 and inet:parse_address/1, while hackney connects to the address it denotes. The same applies to a Location target when redirects are followed.
The IP-literal gate that hackney_url:normalize/2 applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to inet_parse:address/1 as is. The connect path in hackney_happy:parse_address/1 drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected.
This issue affects hackney: from 4.0.1 before 4.9.0.
CVE-2026-112880 is an HTTP Request Splitting vulnerability in the hackney_http_connect module of benoitc hackney. It occurs when the proxy_auth_fun callback returns a value containing CR, LF, or NUL bytes that are not properly sanitized before being inserted into the Proxy-Authorization header during an HTTP CONNECT retry. This allows injection of additional header lines in requests sent to the proxy. The vulnerability affects versions from 2.0.0 up to but not including 4.9.0 and has a low severity rating.
Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.
CVE-2026-116259 is a medium severity memory corruption vulnerability in libimobiledevice up to version 1.4.0. It affects the afc_get_device_info_key function in the src/afc.c file. The flaw is triggered by manipulating the argument Value, causing memory corruption. Exploitation requires local access. Public exploit code is available, but no vendor response or patch has been provided.
PyJWT versions up to 2.13.0 and current master at commit 7144e4534c34810f4525dc4578a32addd8212cff contain a vulnerability where the HMACAlgorithm.from_jwk method accepts an empty HMAC key from an oct JWK without rejection. This allows an attacker to forge tokens by exploiting the zero-length key acceptance during verification via PyJWK, PyJWKSet, or PyJWKClient. The issue arises because the empty-key rejection added in 2.13.0 for string/bytes keys was not applied to the JWK verification path. The vulnerability requires no authentication but depends on the verifier resolving an empty 'k' value from a JWK, which can occur due to misconfiguration or trusting a JWKS with such an entry. A fix is available in version 1.50.0 of the affected product kimi-cli.
CVE-2026-95629 is a path traversal vulnerability in the Apache Camel Docling component affecting versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.2. The issue arises because the CamelDoclingOutputFilePath header value is passed verbatim to the external docling tool's --output flag without proper normalization or directory confinement, allowing an attacker able to set this header to write conversion output files to arbitrary directories writable by the Camel process. The vulnerability is mitigated by upgrading to Apache Camel versions 4.18.5, 4.22.2, or later, which introduce an outputBaseDirectory option to restrict output paths. For versions that cannot be upgraded immediately, users should ensure the header is not influenced by external inputs and is filtered appropriately.
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.
CVE-2026-106676 is an integer overflow vulnerability in qiujie mall-server 0.0.1-SNAPSHOT's CartServiceImpl. An authenticated user can cause a cart quantity to wrap to a negative value. This negative quantity is not validated during order creation and is passed to the stock update query, which can incorrectly increase inventory and create orders with negative values.
CVE-2026-115825 is a high-severity vulnerability in HTTP::Server::PSGI versions before 1.0056 used by Plack for Perl. It allows a remote attacker to crash the server by sending a request with a large Content-Length header, causing excessive memory allocation and an out-of-memory error. The server runs as a single process, so it remains down until manually restarted.
Infinity for Reddit versions up to and including 8.3.4 contain a login cross-site request forgery (CSRF) vulnerability. This flaw allows attackers to log victims into an attacker-controlled Reddit account by exploiting a hardcoded OAuth state value in the app's redirect handler. By authorizing the app's client ID with their own Reddit account and delivering a crafted redirect URL, attackers can cause victims' posts, messages, and browsing actions to be performed on the attacker's account.
CVE-2026-89090 is a denial of service vulnerability in the event stream header decoder of AWS SDK for Go v2 versions prior to 2026-03-23. An unauthenticated remote actor can send a crafted event stream response frame with an invalid header value type, causing the application process to panic and terminate. The issue is fixed in version 2026-03-23 and later.