CVE-2026-40942 affects the Data Sharing Framework (DSF) versions prior to 2.1.0. The vulnerability arises from incorrect time comparison logic in caching mechanisms for OIDC JWKS and Metadata Document as well as OIDC token cache. Specifically, inverted time comparisons cause the OIDC metadata and keys cache to never return cached values, resulting in unnecessary HTTP fetches, and the OIDC token cache to never invalidate, causing expired tokens to be reused. This issue is fixed in version 2.1.0.
CVE-2026-41527 is a vulnerability in KDE Kleopatra versions before 26.08.0 on Windows. It involves an error in the KUniqueService mechanism that is intended to ensure only one instance of the application runs. Due to this flaw, local users can gain the privileges of a Kleopatra user. The vulnerability has a CVSS score of 6.9, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
Varnish Cache version 9.0.0 contains a vulnerability that allows a denial of service via a workspace overflow leading to a daemon panic. This occurs when a malicious client sends an HTTP/1 request, waits for the session to release its worker thread (timeout_linger), and then resumes traffic before the session closes (timeout_idle), sending multiple requests simultaneously to trigger pipelining. The issue stems from incomplete handling of workspace rollback during pipelining, causing prefetched data to exceed workspace limits and crash the server.
Varnish Cache versions prior to 9.0.1 and Varnish Enterprise before 6.0.16r11 contain a vulnerability that can cause a denial of service via a workspace overflow leading to a daemon panic. This occurs during the HTTP/2 session upgrade process when buffer allocation splits the original workspace, and certain amounts of prefetched data cause pipelining operations to exhaust the workspace. The vulnerability is identified as CWE-670, relating to always-incorrect control flow implementation.
An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the compilation of the table.fill instruction can result in a host panic. This means that a valid guest can be compiled with Winch, on any architecture, and cause the host to panic. This represents a denial-of-service vulnerability in Wasmtime due to guests being able to trigger a panic. The specific issue is that a historical refactoring changed how compiled code referenced tables within the table.* instructions. This refactoring forgot to update the Winch code paths associated as well, meaning that Winch was using the wrong indexing scheme. Due to the feature support of Winch the only problem that can result is tables being mixed up or nonexistent tables being used, meaning that the guest is limited to panicking the host (using a nonexistent table), or executing spec-incorrect behavior and modifying the wrong table. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.
CVE-2026-35414 is a medium severity vulnerability in OpenSSH versions prior to 10.3. It involves an always-incorrect control flow implementation (CWE-670) related to the mishandling of the authorized_keys principals option in uncommon scenarios where a principals list is combined with a Certificate Authority that uses comma characters. This flaw may lead to limited confidentiality and integrity impacts but does not affect availability. There are no known exploits in the wild, and no official patch or vendor advisory is currently available.
OpenSSH versions before 10.3 have a vulnerability where specifying any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms causes all ECDSA algorithms to be accepted. This is due to incorrect control flow implementation. The issue is classified under CWE-670 and has a low CVSS score of 3.1.
CVE-2025-58136 is a high-severity vulnerability in Apache Traffic Server versions 9.0.0 through 9.2.12 and 10.0.0 through 10.1.1. It involves a bug in the handling of POST requests that can cause the server to crash under certain conditions.
Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist). As a result: middleware will be completely skipped, the HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler), and the actual handler will still be executed. This issue is fixed in version 11.1.16.
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, A logic error in the PX4 Autopilot MAVLink FTP session validation uses incorrect boolean logic (&& instead of ||), allowing BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors. This enables an unauthenticated attacker to put the FTP subsystem into an inconsistent state, trigger operations on invalid file descriptors, and bypass session isolation checks. This vulnerability is fixed in 1.17.0-rc2.
Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.
soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up function calls. `#[contractimpl]` generates code that uses `MyContract::value()` style calls even when it's processing the trait version. This means if an inherent function is also defined with the same name, the inherent function gets called instead of the trait function. This means the Wasm-exported entry point silently calls the wrong function when two conditions are met simultaneously: First, an `impl Trait for MyContract` block is defined with one or more functions, with `#[contractimpl]` applied. Second, an `impl MyContract` block is defined with one or more identically named functions, without `#[contractimpl]` applied. If the trait version contains important security checks, such as verifying the caller is authorized, that the inherent version does not, those checks are bypassed. Anyone interacting with the contract through its public interface will call the wrong function. The problem is patched in `soroban-sdk-macros` versions 22.0.10, 23.5.2, and 25.1.1. The fix changes the generated call from `<Type>::func()` to `<Type as Trait>::func()` when processing trait implementations, ensuring Rust resolves to the trait associated function regardless of whether an inherent function with the same name exists. Users should upgrade to `soroban-sdk-macros` 22.0.10, 23.5.2, or 25.1.1 and recompile their contracts. If upgrading is not immediately possible, contract developers can avoid the issue by ensuring that no inherent associated function on the contract type shares a name with any function in the trait implementation. Renaming or removing the conflicting inherent function eliminates the ambiguity and causes the macro-generated code to correctly resolve to the trait function.
NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successful exploit of this vulnerability might lead to data tampering.
Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVE-2024-53134 is a vulnerability in the Linux kernel related to the pmdomain imx93-blk-ctrl component. The issue involves an incorrect loop condition that causes the kernel to hang indefinitely, leading to a kernel panic. Additionally, the fix disables runtime power management to address an unbalanced pm_runtime_enable warning.