A security vulnerability (CVE-2026-99999) affecting the Linux kernel's IPv4 implementation in Red Hat Enterprise Linux 9.2 has been addressed. The flaw involves improper validation of the checksum_start value before completing the checksum calculation. Red Hat has released an important security update to fix this issue. The update requires a system reboot to take effect. This vulnerability is rated as having an important security impact by Red Hat, with a high severity classification in the input data. No public exploit or active exploitation is currently known. Users of affected Red Hat Enterprise Linux 9.2 versions are advised to apply the update promptly to improve system security.
A Cross-Site Scripting (XSS) vulnerability exists in the PixelYourSite WordPress plugin versions before 11.4.3 and PixelYourSite Pro versions before 12.6.8. The flaw arises because the plugins do not sanitize and escape a cookie value before outputting it on the page. On sites using full-page caching, this allows unauthenticated attackers to inject malicious scripts into the cached page, which are then served to other visitors.
The Infility Global WordPress plugin versions before 2.16.25 contain a missing authorization vulnerability in an AJAX action accessible to unauthenticated users. This flaw allows any visitor to overwrite a machine-translation configuration value of a companion plugin without proper authorization or nonce verification.
A vulnerability in OpenSSL's CMS AuthEnvelopedData message handling allows network-adjacent attackers who can modify these messages to tamper with their integrity checks. The vulnerability has a low severity rating and requires the attacker to have the ability to alter CMS AuthEnvelopedData messages prior to exploitation.
CVE-2026-110353 is a denial of service vulnerability in HAProxy versions prior to 3.4.6, 3.3.17, and 3.2.26, among others. It arises from an unchecked return value in the HTTP/2 PING frame handler, allowing a remote unauthenticated attacker to cause CPU exhaustion by sending truncated HTTP/2 PING frames. This causes the multiplexer tasklet to spin repeatedly without progress, leading to high CPU usage until the connection times out.
CVE-2026-76292 affects certain versions of Splunk Enterprise and Splunk Secure Gateway where low-privileged users without admin roles can read mobile alert notification data of other users. This occurs due to missing user-level authorization checks on read requests to the Splunk Secure Gateway App Key Value Store REST API endpoints. The issue is fixed in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions 3.10.12, 3.9.26, and 3.8.73.
TastyIgniter versions up to and including 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to execute arbitrary code. This occurs because serialized PHP objects submitted as settings values are stored without sanitization and later unserialized, enabling exploitation via crafted gadget chains. The vulnerability enables arbitrary operating-system command execution with the privileges of the PHP application process user, persisting until the malicious setting value is changed.
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1.
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.
CVE-2026-111805 is a high-severity vulnerability in Apache Traffic Server that allows an attacker to exhaust an HTTP/1.1 origin's worker pool by sending a truncated HTTP/2 Content-Length value. This uncontrolled resource consumption can lead to denial of service conditions. The issue affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register (b->reg_addr) and the data-phase flag (b->rxtx) were never cleared when the controller issued an I2C STOP, so after a completed transfer the target still had a data register selected while the packet buffer that register refers to had already been consumed and set to NULL by mctp_i2c_gpio_target_stop().
A controller on the bus can re-enter the same branch of mctp_i2c_gpio_target_stop() with a NULL buffer using two ordinary transactions and no authentication: first a normal packet write to MCTP_I2C_GPIO_RX_MSG_ADDR followed by STOP (which delivers and frees b->rx_pkt), then a bare read transaction followed by STOP. The failing read_requested() call leaves the stale state untouched and the I2C driver still delivers the STOP callback, which then calls mctp_bus_rx() with a NULL packet. The symmetric case exists on the transmit side, where the stale MCTP_I2C_GPIO_TX_MSG_ADDR selection dereferences b->tx_pkt->end after b->tx_pkt has been cleared and additionally signals b->tx_complete a second time, causing the next outbound packet to be dropped.
The dereference happens in the I2C target interrupt handler, so on any target that traps accesses to address 0 the result is a fatal exception and a device reset or halt — a denial of service inflicted by any device able to act as controller on the shared management bus (for example compromised firmware on a peer MCTP endpoint or on the BMC). On parts where address 0 is readable, the impact degrades to a malformed packet buffer being handed to the MCTP stack and lost transmit packets. No attacker-controlled value is written and no confidentiality or integrity boundary is crossed.
The fix resets b->reg_addr to MCTP_I2C_GPIO_INVALID_ADDR and clears b->rxtx at every STOP, so a new register must be selected before any data phase can run again. Only builds that opt into the experimental CONFIG_MCTP subsystem with CONFIG_MCTP_I2C_GPIO_TARGET=y are affected.
CVE-2026-20011 is a medium severity vulnerability in Cisco Open Source Snort3 affecting multiple versions. It involves a buffer access issue with incorrect length values in the Snort 3 SMTP MIME Decoder. An unauthenticated remote attacker can exploit this by sending crafted SMTP packets, causing the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS).
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it consistently to text content and to attribute values — `href`, `src`, `alt`, `id`, `data-author`, `data-date`, citation text all go through it. The inline CSS strings do not. In `renderTextSpan` (`dist/odt/to-html/html-renderer.js:195`), the value of e.g. `fo:color` is copied from the document into `style.fontColor` verbatim by the parser (`extractSpanStyle`, read/parser.js:348), then concatenated raw into the attribute. A `"` in the value terminates the attribute early. The same unescaped `style="${...}"` pattern appears at roughly ten other emission sites: paragraph and heading (`paragraphStyleToCss`), table cells and rows (`cellStyleToCss`, `rowStyleToCss`), `<col>`, and the image style attribute. The affected source attributes include `fo:color`, `fo:background-color`, `fo:text-shadow`, `fo:letter-spacing`, `fo:font-family` (via both direct and font-face resolution), `fo:margin-*`, `fo:padding-*`, `fo:line-height`, `fo:border*`, and `style:vertical-align`. Version 0.14.2 contains a patch.
CVE-2026-56387 is a high-severity vulnerability in Apache bRPC's RTMP AMF parser that allows remote unauthenticated attackers to cause excessive memory allocation or resource consumption by sending crafted AMF payloads with large declared string lengths or array counts. This occurs because the parser resizes buffers based on unvalidated length fields before verifying the actual payload size. The issue affects bRPC versions prior to 1.18.0 when RTMP is enabled and exposed to untrusted clients. The vulnerability is fixed in version 1.18.0, which introduces configurable limits on maximum string size and array element count to prevent excessive resource use.
CVE-2026-112896 is a heap out-of-bounds read vulnerability in Pillow's TIFF encoder caused by a mismatch in the expected ColorMap plane size when saving TIFF images with 16-bit samples. The issue arises when a TIFF image with a malformed ColorMap tag containing 768 SHORT values is loaded and then saved without reconciling the ColorMap size with the BitsPerSample value. This leads to a heap-buffer-overflow read during encoding, detected by ASAN, potentially exposing process memory. The vulnerability requires the application to load and save TIFF images using Pillow's libtiff-backed encoder with retained metadata. No arbitrary code execution or confirmed memory disclosure is demonstrated. The vulnerability has a CVSS 4.0 score of 8.8 (high severity).
CVE-2026-35501 is a vulnerability in NLnet Labs Unbound DNS resolver versions 1.0.1 through 1.26.1. It occurs when Unbound is configured with both a root trust anchor and an additional trust-anchor for an island-of-security zone whose parent is insecure. A malicious actor can exploit this by sending a forged NSEC reply with the SOA bit cleared, causing Unbound to incorrectly treat the trust island as insecure. This happens because the DNSSEC validator accepts and caches the NSEC insecure response without proper RRSIG validation. The issue stems from an old fix related to DS and NSEC queries when a trust anchor exists for that name. The vulnerability has a low CVSS score of 3.7 and was fixed in version 1.26.2.
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared
and no user interaction beyond launching it, can execute arbitrary shell
commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects
combine: (a) OnePlus's atlasservice binder interface accepts
setEvent(String8 name, String8 value) from any caller without
authorization, and (b) one event handler
(OplusAtlasLogWriter::handleEvent, matching event name
atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value
into the system property oplus.audio.dumpinfo.type and starts the root
init service audiodumpinfo, which passes that property value unsanitized
to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.