CVE-2026-110682 is a vulnerability in Cpanel::JSON::XS Perl module versions 4.42 up to but not including 4.80. It involves an interpretation conflict in the incremental JSON parser (incr_parse) where input chunking can alter the decoded value of top-level numbers. Because allow_nonref is enabled by default, the parser decodes partial input chunks differently depending on read boundaries, allowing a peer controlling these boundaries to influence the number and content of decoded messages.
CVE-2026-11319 is a path traversal vulnerability in TickTick for Android version 8.2.2.0. It exists in the exported ShareReceiveActivity component, allowing a malicious local app to write files outside the intended attachment directory by supplying a crafted content URI with traversal sequences. This occurs because the application does not sanitize the _display_name value returned by a malicious ContentProvider, leading to unauthorized file writes with TickTick's privileges.
CVE-2026-107569 is a high-severity vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It involves unchecked input for a loop condition related to the X-hMailServer-LoopCount header, which controls mail forwarding and auto-reply cycles. An attacker can set this header to a negative or out-of-range value, causing the server to enter a mail generation loop that can exhaust resources and stop mail service. The issue affects various mail generation rules and Sieve actions, with some lacking proper limits or validation.
CVE-2026-107566 is a missing authorization vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It allows an authenticated user to manipulate email headers via the Sieve editheader action or mail-rule Set header value action to send emails as any address within domains the server signs for with DKIM signatures. This can result in forged emails that pass DMARC validation by altering From and DKIM-Signature headers without proper authorization.
CVE-2026-112283 is a vulnerability in VideoLAN libbluray up to version 1.5.1 where the _parse_extent_start_points() function improperly trusts the num_point field without bounds checking. This allows an attacker to supply a crafted .clpi file with an excessively large num_point value, leading to uncontrolled memory allocation and CPU exhaustion, resulting in a denial of service condition.
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
@fastify/oauth2 versions 7.2.0 through 8.3.1 contain a Cross-Site Request Forgery (CSRF) vulnerability due to inconsistent cookie Path attributes for state and code-verifier cookies during OAuth2 login flows. This inconsistency allows the state cookie to persist beyond the OAuth callback, violating the single-use guarantee. An attacker who learns a valid state value can perform login CSRF by forcing the victim's browser to sign into the attacker’s account. The issue is fixed in version 8.3.2.
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
CVE-2026-85243 is a vulnerability in Apache Camel's Crypto PGP component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The issue arises because the unmarshal() function only verifies the modification detection code for OpenPGP symmetrically encrypted integrity protected data packets, but older packet types lack this integrity check. This allows an attacker who can modify messages in transit to bypass integrity validation. Apache Camel 4.23.0, 4.18.5, and 4.22.1 include fixes that add a requireIntegrityProtection option to enforce integrity checks on incoming messages.
MISP versions prior to 2.5.48 contain a CSS injection vulnerability in the remote event preview feature. This occurs because the colour value of remote tags is inserted directly into an inline CSS style attribute without sufficient validation. An attacker controlling a linked MISP server can inject arbitrary CSS by crafting malicious tag colour values, which are then rendered when a user previews events from that linked server. This can lead to UI manipulation, visual spoofing, or limited information disclosure via CSS techniques.
Red Hat has issued a security advisory for nodejs22 addressing two denial of service vulnerabilities. The first vulnerability (CVE-2026-9496) involves the pacote package where a crafted spec.rawSpec value in the addGitSha function can cause denial of service. The second vulnerability (CVE-2026-19534) involves the undici package where an unrequested WebSocket subprotocol can lead to denial of service. These issues affect Red Hat Enterprise Linux 10.0 Extended Update Support versions. The advisory rates the impact as Important (high severity).
Red Hat has issued a security update for the nodejs:22 module in Red Hat Enterprise Linux 9.6 Extended Update Support. The update addresses two denial of service vulnerabilities: CVE-2026-9496 in the pacote package via a crafted spec.rawSpec value, and CVE-2026-19534 in the undici package via an unrequested WebSocket subprotocol. These vulnerabilities could allow denial of service conditions in affected Node.js components.
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
CVE-2026-104627 is an improper authentication vulnerability in Gitea's OpenID association callback within security settings. The flaw allows an attacker-controlled OpenID provider to link the attacker's identity to a victim's account without the victim's initiation, enabling the attacker to sign in as the victim bypassing local two-factor authentication methods like TOTP or WebAuthn. The issue arises because OpenID 2.0 permits unsolicited assertions, and the callback did not verify that the signed-in user initiated the linking. The vulnerability affects Gitea versions up to 28.1.0. A fix has been implemented requiring a time-limited, user-bound 'state' value in the callback to prevent this attack.
A vulnerability in the Linux kernel's net/packet subsystem involving TX_RING byte count overflow has been resolved. The issue arises because tpacket_snd() accumulates packet lengths in a signed integer, which can overflow into the negative range after many transmissions. This causes sock_sendmsg_nosec() to misinterpret the value and trigger a kernel BUG, potentially leading to a kernel panic on systems configured to panic on oops. The flaw allows a CAP_NET_RAW user to cause a host kernel panic. The fix prevents the byte count from exceeding INT_MAX by stopping before the overflow occurs.
A use-after-free (UAF) vulnerability in the Linux kernel's vc_screen component was resolved by reloading the vc pointer before checking the return value in the vcs_write() function. The issue occurred because the vc pointer could become stale and non-NULL after being freed, leading to a read from freed memory in vcs_notifier(). This could cause kernel memory corruption and crashes.
A vulnerability in the Linux kernel's rtc: mpfs driver was fixed by adding proper error checking for the devm_clk_get() function's return value in the probe() function. Previously, an error pointer returned by devm_clk_get() was passed unchecked to clk_get_rate(), which only checks for NULL pointers, causing a potential kernel crash. The fix involves checking the return value with IS_ERR() before usage, preventing crashes during driver probe when dependent clocks are not yet registered.
A vulnerability in the Linux kernel related to the SO_RESERVE_MEM socket option has been resolved. The issue involved improper handling of SO_RESERVE_MEM on UDP sockets, which are only supported for TCP sockets. This could lead to memory accounting corruption due to concurrent operations and lack of proper locking. Additionally, there was no upper bound on the SO_RESERVE_MEM value, allowing large values to cause integer overflow and memory corruption. The fix restricts SO_RESERVE_MEM usage to TCP sockets and caps the maximum value to 1GB.
A memory leak vulnerability in the Linux kernel's amdgpu driver was fixed. The issue occurs when kobject_add() fails during the initialization of ip_hw_instance, causing the allocated memory not to be freed. This happens because the failure return value is ignored and the initial kobject reference is not dropped, preventing normal cleanup. The fix involves calling kobject_put() on failure to properly release the allocation and avoid the leak.
A vulnerability in the Linux kernel's mac80211 minstrel_ht component allows out-of-bounds memory access via the fixed_rate_idx debugfs file. This file accepts any u32 value, which can lead to invalid indexing of internal arrays and kernel memory corruption. The debugfs file is only accessible to root users, so this is not a privilege escalation issue but remains a critical kernel memory safety bug.