A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.
CVE-2026-109619 is a high-severity vulnerability in PHP where internal request state can persist after its backing memory has been freed. This stale state may be used by a later request handled by the same worker before it is properly reinitialized, potentially allowing remote code execution. The issue affects multiple PHP versions across various Ubuntu releases. Official patches are available and should be applied to mitigate the risk.
A critical vulnerability in PHP (CVE-2026-109618) involves improper handling of out-of-memory conditions during request processing, which can cause PHP to crash or execute arbitrary code. This occurs because internal request data may be only partially initialized when interrupted, leading to invalid data being treated as valid during cleanup. The issue affects multiple PHP versions across various Ubuntu releases. Fixes are available and should be applied via standard system updates.
A high-severity vulnerability (CVE-2026-97313) affecting specific versions of Bind9 has been published. The vulnerability has a CVSS 3.1 score of 7.5, indicating a network attack vector with low complexity and no privileges or user interaction required, resulting in high impact on availability but no impact on confidentiality or integrity. A security update addressing this vulnerability is available for the affected Bind9 versions.
A high severity vulnerability (CVE-2026-96888) affecting multiple specific versions of Bind9 has been published. The vulnerability has a CVSS 3.1 score of 7.5, indicating a network exploitable issue with no required privileges or user interaction, causing a high impact on availability. This security update addresses the flaw in the affected Bind9 versions.
A high-severity security vulnerability (CVE-2026-94300) has been identified in specific versions of Bind9 DNS server software. The vulnerability has a CVSS 3.1 base score of 8.1, indicating a network attack vector with high impact on confidentiality, integrity, and availability. Multiple Ubuntu package versions of Bind9 are affected.
A high severity vulnerability (CVE-2026-19630) affecting specific versions of Bind9 has been published. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to availability, with no confidentiality or integrity impact reported. Multiple specific Ubuntu package versions of Bind9 are affected.
NLnet Labs Unbound up to and including version 1.26.1 contains a vulnerability identified as CVE-2026-109125. The vulnerability has a medium severity with a CVSS score of 5.3. It involves an observable issue that impacts the integrity of the system but does not affect confidentiality or availability. The affected versions include multiple specific builds primarily related to Ubuntu distributions. No public exploit code or known exploitation in the wild has been reported.
NLnet Labs Unbound versions from 1.22.0 up to and including 1.26.1 contain a vulnerability identified as CVE-2026-97206. This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, and affects multiple Ubuntu package versions. The flaw does not impact confidentiality or integrity but results in a high impact on availability.
CVE-2026-96405 is a medium severity vulnerability affecting NLnet Labs Unbound versions up to and including 1.26.1. The vulnerability relates to limitations in compression handling, causing an availability impact without compromising confidentiality or integrity. No known exploits are reported in the wild. The affected versions include specific Ubuntu package versions of Unbound. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a moderate risk primarily due to potential denial of service.
OpenStack Cinder through version 29.0.0 contains a vulnerability that allows cross-project information disclosure. This issue has a medium severity with a CVSS score of 4.3, indicating limited confidentiality impact without integrity or availability effects.
OpenStack Manila versions before 23.0.1 contain multiple vulnerabilities in API operations that allow an attacker with low privileges to cause a critical impact on confidentiality, integrity, and availability. The vulnerability has a very high CVSS score of 9.9, indicating severe risk. The affected versions include multiple Ubuntu package releases of Manila. No public exploit or known in-the-wild exploitation is reported. The vulnerability is classified as critical.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.22.18. See the following advisory for the container images for
this release:
https://access.redhat.com/errata/RHSA-2026:79154
Security Fix(es):
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege
escalation via incorrect Punycode label processing (CVE-2026-39821)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.22 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.
Dulwich versions from 0.22.5 up to but not including 1.2.8 contain a path traversal vulnerability. This flaw allows an attacker with local access and user interaction to potentially read, modify, or delete files outside the intended directory. The vulnerability has a high severity rating with a CVSS score of 7.8. Multiple specific package versions, including various Ubuntu builds, are affected.
Dulwich versions from 0.23.1 before 1.2.8 contain a path traversal vulnerability that can lead to high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 7.8, indicating high severity. It requires local access with low attack complexity and no privileges but user interaction. The vulnerability affects multiple specific versions of Dulwich, including various Ubuntu package builds. No public exploits or known active exploitation have been reported.
Dulwich versions from 0.24.0 up to but not including 1.2.8 contain a vulnerability related to symlink following. This vulnerability has a high severity with a CVSS score of 7.8. It affects multiple Ubuntu package versions. No public exploits are known in the wild as of the published date.
Dulwich versions before 1.2.9 contain a denial of service vulnerability that can be triggered remotely without privileges. The vulnerability does not impact confidentiality or integrity but can cause service disruption. The CVSS score is 6.5 (medium severity).
Dulwich versions before 1.2.9 contain a vulnerability related to improper validation of DOS drive letter prefixes in Git operations. This flaw can lead to high-impact consequences including confidentiality, integrity, and availability breaches. The issue affects multiple specific versions of Dulwich as listed. The vulnerability has a high CVSS score of 8.8, indicating significant risk if exploited. No public exploits or known in-the-wild exploitation have been reported. No patch or remediation details are provided in the input data.