CVE-2026-89090 is a denial of service vulnerability in the event stream header decoder of AWS SDK for Go v2 versions prior to 2026-03-23. An unauthenticated remote actor can send a crafted event stream response frame with an invalid header value type, causing the application process to panic and terminate. The issue is fixed in version 2026-03-23 and later.
An integer overflow or wraparound vulnerability has been identified in GitLab version 3.0. This type of vulnerability can lead to unexpected behavior in software when integer calculations exceed their maximum value and wrap around, potentially causing security issues.
CVE-2026-115995 is a critical OS command injection vulnerability in Unitree Robotics Unitree Go2 versions 1.1.11.0 through 1.1.11.4. The flaw exists in the set_volume function within the gpt_thread.py file of the chat_go component. This vulnerability allows remote attackers to execute arbitrary OS commands by manipulating the argument Value. The issue is resolved by upgrading to version 1.1.11.5.
This content discusses the cybersecurity strategy of reducing the attack surface by minimizing unnecessary technology complexity within enterprise environments. It highlights recent high-severity PHP vulnerabilities that prompted urgent advisories and temporary website shutdowns, illustrating challenges in identifying and patching embedded vulnerable components. The article emphasizes that many enterprises accumulate redundant applications and dependencies over time, increasing security obligations without proportional business value. Reducing unnecessary software and infrastructure can lower risk and improve security sustainability.
CVE-2026-114629 is a high-severity vulnerability in Web::Simple for Perl versions before 0.035. It involves excessive memory allocation based on the Content-Length header for urlencoded body parameters. An attacker can send a large Content-Length value to cause the application to allocate a large buffer, potentially leading to resource exhaustion. No authentication is required to exploit this issue. The vulnerability is fixed in version 0.035.
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.
The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.
After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.
A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.
This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.
This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.
CVE-2026-115892 is a type confusion vulnerability in the Wasmtime runtime for WebAssembly. It affects versions from 46.0.0 up to but not including 48.0.7, and from 49.0.0 up to but not including 49.0.4. The flaw occurs when lowering a host-created component-model stream or future into a guest, omitting a required payload-type check after the value passes through guest code. A malicious guest controlling exported function types or returned values can cause the host to pass a type-erased value to a guest expecting a different payload type, resulting in a panic in the Wasmtime host. The issue is fixed in versions 48.0.7 and 49.0.4.
CVE-2026-115889 is a critical numeric truncation error vulnerability in the Cranelift compiler backend used by Wasmtime, a WebAssembly runtime. Versions prior to 36.0.19 and between 37.0.0 and before 43.0.0 are affected. The issue arises from bit-packing SSA value indices that can overflow silently in release builds when compiling large or specially crafted Wasm functions. This overflow can cause incorrect intermediate representation references, leading to arbitrary miscompilation, type confusion, and potentially allowing attacker-controlled effects to escape the Wasm sandbox. The vulnerability is fixed in Wasmtime versions 36.0.19 and 43.0.0.
Twisted versions prior to 26.10.0rc1 have a vulnerability in twisted.web.http.HTTPChannel.headerReceived where it rejects NUL bytes in HTTP header values but accepts bare carriage return or line feed characters. This allows a hidden Content-Length header to be folded into another header value, causing a framing disagreement between Twisted and lenient front ends. This can enable HTTP request smuggling, potentially bypassing front-end access controls, poisoning shared connections or caches, and exposing clients to incorrect responses. The issue is a residual flaw from incomplete fixes in earlier request-smuggling protections and is resolved in version 26.10.0rc1.
Echo v5 contains a vulnerability in the ExtractIPFromRealIPHeader function where it trusts the X-Real-IP header value without verifying the direct network peer's address. This allows an untrusted client to spoof IP addresses such as loopback or private addresses. Applications relying on this extractor for IP allowlists, rate limiting, audit logs, or forwarding headers may accept spoofed client identities. Versions from 5.0.0 through 5.4.0 are affected. The issue is fixed in version 5.4.1 by validating the direct peer before accepting the X-Real-IP header.
A command injection vulnerability exists in pypa virtualenv versions 21.14.9 through 21.14.12. The bash bin/activate script improperly handles an attacker-controlled --prompt value, allowing unescaped dollar signs or backticks to be copied into the PS1 environment variable. When promptvars and POSIX mode are disabled, this can lead to command substitution and execution when the environment is activated or an interactive bash shell inherits PS1. This issue is fixed in version 21.14.13.
A vulnerability in the Linux kernel's CAN network subsystem was resolved by restoring skb header initialization in the init_can_skb() function. The issue was introduced when certain skb header reset calls were removed, causing RX skbs to carry an invalid mac_header value. This leads to an overflow in push length calculation in packet_rcv_spkt(), triggering a kernel panic and full machine crash. The problem was originally reported in 2014 and fixed then, but the recent commit reintroduced it. The vulnerability affects kernel stability and can cause denial of service via system crash.
A vulnerability in the Linux kernel's drm/vmwgfx component allowed improper validation of the pitch value received from userspace. This flaw could lead to out-of-bounds reads when copying data from the underlying surface, potentially exposing sensitive information through cursor snooping. The issue has been resolved by adding validation checks for the pitch and box dimensions before data copying.
A vulnerability in the Linux kernel's flow_dissector component involves improper handling of the hlen value in the bpf_flow_dissect() function. The function clamps offsets using a 16-bit unsigned integer, which causes truncation when hlen exceeds 65535. This truncation can force offset values to zero incorrectly, potentially affecting packet processing. The issue is similar to a previously fixed bug but affects the BPF path specifically. The flaw has been identified and resolved in the Linux kernel.