A Linux kernel vulnerability (CVE-2026-99105) involves a stall condition when a task enqueued with SCX_ENQ_LAST returns to its CPU's local dequeue queue (DSQ). This issue causes the CPU to idle with the task queued until an unrelated wakeup or watchdog event occurs, potentially leading to long stalls during task exit, such as during mass cgroup teardown.
CVE-2026-105457 is a path traversal vulnerability in HAVELSAN Inc. Liman MYS versions before 2.3.5-1132. This flaw allows an attacker with low privileges to access restricted directories by manipulating pathnames. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.
CVE-2026-99116 is a use-after-free vulnerability in the Linux kernel's net: psp component. It occurs because socket cloning improperly inherits the Rx association without taking a reference, leading to multiple timewait sockets sharing a freed pointer. This can cause kernel memory corruption and crashes. The issue is fixed by clearing the association on socket clone to prevent inheritance.
The PayPal Brasil para WooCommerce plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 1.7.8. This flaw allows unauthenticated attackers to enable or disable the PayPal Brasil BCDC payment gateway and modify its WooCommerce gateway settings, effectively removing PayPal as a payment option for all customers.
An improper input validation vulnerability in the Headless component of Google Chrome versions prior to 156.0.8078.73 allows a remote attacker to potentially execute arbitrary code inside the sandbox by delivering a crafted HTML page. This vulnerability has been fixed in version 156.0.8078.73.
CVE-2026-110879 is a critical deserialization vulnerability in FasterXML jackson-databind affecting versions from 2.10.0 up to but not including fixed releases 2.18.12, 2.21.8, 2.22.4, 3.1.8, and 3.2.4. The flaw allows attacker-controlled classes inside generic type arguments to bypass validation, enabling deserialization of malicious payloads. This can lead to arbitrary code execution, notably when combined with Spring on the classpath and attacker-controlled XML input.
CVE-2026-110747 is an integer overflow vulnerability in the FasterXML jackson-dataformat-protobuf library's ProtobufParser._readStringKey() method. The flaw occurs when parsing a protobuf map entry's string key length, allowing an attacker to cause an integer overflow that bypasses length checks and triggers an OutOfMemoryError. This can lead to JVM termination if the application is configured with -XX:+ExitOnOutOfMemoryError. The vulnerability affects specific versions in the 2.x and 3.x branches but has been fixed in later releases.
CVE-2026-104895 is a high-severity vulnerability in the FasterXML jackson-dataformat-smile library's asynchronous Smile parser. It involves unbounded memory allocation based on a length prefix from untrusted input, leading to potential OutOfMemoryError or NegativeArraySizeException crashes. The flaw allows attackers to cause denial of service by submitting crafted Smile data without requiring privileges or user interaction. Fixed versions are available.
CVE-2026-104016 is an integer overflow vulnerability in FasterXML jackson-dataformat-protobuf affecting multiple version ranges before fixed releases. The flaw occurs during parsing of length-prefixed protobuf string and bytes fields, where 32-bit signed integer arithmetic overflow allows bypassing bounds checks. This leads to an attempt to allocate an excessively large array, causing an OutOfMemoryError. The issue cannot be mitigated by JVM heap size tuning or existing string/document length limits. No special privileges or user interaction are required beyond submitting data for parsing. Fixed versions are available.
A vulnerability in Thunderbird allowed clicking on news: or snews: links referencing a message-ID to cause the client to connect automatically to an attacker-specified host and port without user consent, even if the server was not configured. Line breaks in the message-ID were sent unmodified, enabling crafted links to send arbitrary commands to reachable services. Additionally, snews: links connected without TLS, exposing data to interception. This issue was fixed in Thunderbird versions 159 and 153.6.
undici is vulnerable to a denial of service condition triggered by a TLS 1.2 server-initiated renegotiation presenting a different, valid but hostname-mismatched certificate. This causes an uncaught assertion error that crashes the Node.js client process, affecting both HTTP/1.1 and HTTP/2. Only TLS 1.2 is impacted, as TLS 1.3 does not support renegotiation. The issue is fixed in undici versions 6.29.1, 7.30.1, and 8.12.2. Mitigation includes upgrading to these versions or restricting connections to TLS 1.3 to prevent renegotiation.
A local privilege escalation vulnerability was identified and addressed by Tanium in its End-User Notifications component. This vulnerability could allow a local attacker to gain elevated privileges on the affected system. The issue has a high severity rating with a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No specific affected versions or patch details are provided in the available data.
A vulnerability in Autodesk Fusion Post Processor Utility Extension allows a maliciously crafted .stack.json file to trigger a trusted Markdown injection. This can lead to arbitrary command execution in the context of the current user.
PhpSpreadsheet's XmlScanner performs two scans on XML content, each followed by an entity decoding callback that runs after pattern checks. This allows a double-encoded entity sequence to bypass detection of dangerous <!DOCTYPE declarations, enabling XML External Entity (XXE) injection and Denial of Service (DoS) via entity expansion. The vulnerability affects PhpSpreadsheet versions >=3.3.0 <3.10.8 and >=4.0.0 <5.10.0. It is exploitable for DoS on all PHP versions and for XXE/SSRF on PHP versions below 8.0 or when LIBXML_NOENT is used. Fixed in versions 3.10.8 and 5.10.0.
A vulnerability in snappy-java prior to version 1.1.10.9 allows JVM crashes due to unchecked array range parameters in Snappy.arrayCopy and related stream read/write methods. The flaw arises from native memcpy calls without validating offsets and lengths, leading to out-of-bounds memory access and JVM crashes. This issue has been fixed in version 1.1.10.9 by adding proper range checks.
CVE-2026-117958 is a site isolation vulnerability in the Networking: HTTP component of Firefox. This security flaw was addressed and fixed in Firefox version 159 and Firefox ESR 153.6. The issue could potentially impact the browser's security model related to site isolation. No active exploitation in the wild has been reported.
CVE-2026-117949 is a use-after-free vulnerability in the DOM Core & HTML component of Firefox. This security flaw was addressed and fixed in Firefox version 159, Firefox ESR 115.44, and Firefox ESR 153.6. The vulnerability is rated with high impact by the vendor.
A heap-based buffer overflow vulnerability exists in multiple JP1 products, including JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager and Agent editions, and JP1/Base. The affected versions range from 13-00 up to but not including 13-50-31 for the first four products, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability has a high CVSS score of 9.4, indicating critical severity with potential for high impact on confidentiality and integrity.
An improper certificate validation vulnerability in Moxa Remote Connect Suite (MRC Client) allows an unauthenticated attacker with on-path access to impersonate a trusted server. This can enable a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications between the client and server.