baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes the visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits it with explode(',') and supplies every resulting address to setTo(). Newly created forms with an email-type field are affected when the separate, optional VALID_EMAIL server-side validation is not enabled; browser type=email validation does not prevent crafted requests. The bundled contact form enables VALID_EMAIL and is not affected. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, allowing abuse of the site to deliver unsolicited mail. This issue has been patched in versions 5.3.2 and 5.4.2.
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.
i18next-http-backend version 4.0.2 contains an incomplete fix in the interpolateUrl() function that allows attackers to manipulate translation request URLs by supplying a namespace value starting with a slash. This can lead to loading attacker-hosted translations, enabling UI content injection and cross-site scripting (XSS). The vulnerability is fixed in version 4.0.3.
Heimdall versions prior to 0.17.17 have an improper input validation vulnerability in proxy mode where the Host header value is inserted unsanitized into the Forwarded HTTP header. This allows attackers to inject additional parameters, potentially spoofing IP addresses for upstream services. The issue is fixed in version 0.17.17.
A vulnerability in the Linux kernel's CAN network subsystem caused by missing initialization of socket buffer (skb) headers in the init_can_skb() function can lead to a kernel panic. This occurs because RX skbs carry an invalid mac_header value, which triggers an overflow in packet_rcv_spkt(), resulting in a kernel BUG and full machine panic. The issue was introduced by a commit that removed skb header resets and has been fixed in later kernel versions.
CVE-2026-99002 is a high-severity vulnerability in the Linux kernel's drm/vmwgfx component. It involves insufficient validation of the pitch value received from userspace before copying data from the underlying surface. This flaw could lead to out-of-bounds reads, potentially allowing unauthorized access to kernel memory via cursor snooping. The issue has been fixed in specific Linux kernel commits.
A vulnerability in the Linux kernel's btrfs filesystem code was fixed by changing the return value of btrfs_uring_read_extent_endio to always return -EIOCBQUEUED. Previously, if all bios finished before btrfs_encoded_read_regular_fill_pages() returned, a negative errno could cause double unlocking and freeing of resources, leading to potential memory corruption or instability.
CVE-2026-98959 is a critical vulnerability in the Linux kernel's Btrfs filesystem related to extended attribute (xattr) handling. When multiple xattrs are packed in the same btrfs_dir_item and one xattr is replaced with a value of a different size, the kernel fails to fully initialize the new btrfs_dir_item. This causes filesystem corruption detected during extent buffer writeback, leading to transaction aborts and potential data loss. The issue occurs because the deletion and insertion of xattr items shift data in the leaf, leaving parts uninitialized. The vulnerability affects multiple Linux kernel versions prior to 3.11, 3.13, 3.15, and 3.19, with fixes applied in those versions. The CVSS 3.1 score is 9.8, indicating critical severity.
A vulnerability in the Linux kernel's flow_dissector component caused incorrect computation of the transport header offset (thoff) due to 16-bit truncation of skb->len. This truncation led to thoff being set to an incorrect small value, potentially causing the transport header pointer to reference incorrect packet data. The issue affected multiple Linux kernel versions and was fixed by comparing lengths as 32-bit values and capping thoff when necessary.
A vulnerability in the Linux kernel's flow_dissector component causes improper handling of the hlen value in the bpf_flow_dissect() function. Specifically, when hlen exceeds 65535, it is truncated due to a u16 data type limitation, leading to incorrect offset calculations. This issue was fixed by capping hlen to the maximum value of a u16 before clamping. The flaw affects version 4.20 of the Linux kernel.
A vulnerability in the Linux kernel MMC core allows a host driver to set an excessively large max_segs value, which can be truncated to zero. This causes a zero-size memory allocation that leads to invalid memory access and a kernel crash. The issue is fixed by adding validation to reject zero-length scatter-gather lists, preventing the crash and allowing host driver developers to correct their configurations.