A resource consumption vulnerability exists in the Twisted framework prior to version 26.10.0rc1. The IRC protocol implementation buffers all received bytes without a line feed in a per-connection buffer without enforcing a maximum line length. This allows an unauthenticated connection to cause unbounded memory growth, potentially exhausting server memory and causing denial of service. The issue is fixed in version 26.10.0rc1.
CVE-2026-115775 is a high-severity vulnerability in the Twisted event-based framework for Python. The issue exists in the twisted.words.xish.domish ExpatElementStream parser prior to version 26.10.0rc1, where an unauthenticated remote peer can keep a container element open while continuously adding child elements. This causes the parser to retain the unfinished stanza as an in-memory tree without limits, potentially exhausting server memory and causing process termination. The vulnerability is fixed in version 26.10.0rc1.
CVE-2026-115774 is a vulnerability in the Twisted event-based framework affecting versions prior to 26.10.0rc1. It involves an uncontrolled resource consumption issue triggered by a negative literal size in an authenticated IMAP SEARCH command. This causes the parser cursor to move below zero, leading to an infinite loop that freezes the single-threaded reactor. The freeze halts all IMAP connections and any SMTP or POP3 services running in the same process until the service is restarted. The issue is fixed in version 26.10.0rc1.
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.
_language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.
A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.
The php2shell vulnerability involves complex exploitation steps requiring specific memory conditions and environment setups. Proofs of concept (PoCs) published so far rely on artificial conditions such as low memory limits and single-worker configurations, which are uncommon in real-world deployments. The exploit involves leaking memory addresses to defeat ASLR and modifying function pointers to execute commands, but command size is limited. Disabling session.upload_progress is recommended as a mitigation until an official fix is available.
A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks.
CVE-2026-79982 is a high-severity vulnerability in the Zephyr project's Bluetooth HCI USB transport class. It involves a buffer overflow caused by copying oversized HCI packets into a fixed-size USB transfer buffer without proper length checks. This can lead to memory corruption or denial of service. The flaw affects Zephyr versions from 3.3.0 through 4.4.2. An attacker within Bluetooth range can exploit this by sending oversized packets, potentially causing arbitrary code execution on systems without memory protection or triggering a panic on others.
CVE-2026-79981 is a medium severity vulnerability in the Zephyr project's DNS stub resolver. The resolver binds a single UDP socket with a fixed ephemeral source port for all DNS queries to a configured server, violating RFC 5452's requirement that both source port and transaction ID vary. This allows an off-path attacker with UDP reachability to the device to guess the source port easily and flood forged DNS responses, potentially causing the application to resolve attacker-chosen addresses. The vulnerability affects Zephyr versions from 1.8.0 up to but not including 4.5.0. A patch is available that randomizes the source port per query, increasing the guessing space and mitigating the risk.
CVE-2026-79980 is a medium severity vulnerability in the DHCPv4 client of the Zephyr project. The client used a predictable transaction identifier that was incremented or reused rather than randomized per transaction as required by RFC 2131. This allowed an attacker who observed one identifier to predict future identifiers and forge DHCP replies. Such forged replies could redirect network traffic by changing the device's default gateway and DNS resolvers or disrupt network configuration by sending forged DHCPACK or DHCPNAK messages. A patch is available that ensures a fresh random transaction identifier is generated for each DHCP transaction phase.
CVE-2026-79979 is a use-after-free vulnerability in the Zephyr project affecting arm64 builds with CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled. The issue arises from improper TLB invalidation that only targets ASID 0, allowing stale translations for other ASIDs to persist. This flaw enables unprivileged user threads to access and modify kernel or other domain memory, breaking memory isolation and potentially leading to full system compromise. The vulnerability affects Zephyr versions from 4.3.0 up to but not including 4.5.0. A fix has been implemented to correct the TLB invalidation to cover all ASIDs and preserve proper memory domain permissions.
CVE-2026-79978 is a low-severity vulnerability in the Zephyr RTOS affecting the ADXL345 accelerometer driver. The issue arises from out-of-bounds writes during FIFO data processing when the allocated buffer is smaller than a full batch. This can cause silent data corruption or crashes due to memory corruption in the RTIO block pool. Exploitation requires specific hardware configuration and buffer pool starvation conditions.
CVE-2026-79977 is a vulnerability in the WireGuard VPN implementation within Zephyr (subsys/net/lib/wireguard/wg.c) that allows an attacker to spoof the peer endpoint address without authentication. This occurs because the code updates the peer endpoint from unauthenticated messages when the receiver index does not match any session. The flaw enables an attacker to redirect traffic to an arbitrary address, causing denial of service or limited traffic interception without decrypting or forging tunnel content. The vulnerability affects Zephyr versions from 4.4.0 through 4.4.2. A fix removes unauthenticated endpoint updates and restricts handshake initiation to authenticated endpoints or configured endpoints. WireGuard in Zephyr is experimental and not enabled by default.
Zephyr's OpenThread integration used a default, publicly known Joining Device Credential (PSKd) "J01NME" when the joiner autostart feature was enabled but the PSKd was not overridden. This allowed an attacker within radio range to authenticate as a commissioner and provision the device with a malicious operational dataset, effectively taking control of the device's Thread network connection. The vulnerability affects Zephyr versions from 1.14.0 up to but not including 4.5.0. A fix was implemented to remove the default PSKd and enforce build-time checks requiring a unique PSKd when joiner autostart is enabled.
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.
pypdf versions prior to 6.21.2 contain a vulnerability where repeated malformed cross-reference entries can cause excessive resource consumption by triggering complete PDF stream reloads during recovery attempts. This issue leads to long runtimes when processing crafted PDF files. The vulnerability is fixed in version 6.21.2.
A vulnerability in the pypdf library prior to version 6.21.2 allows an attacker to craft a PDF file with a cross-reference table declaring more entries than the file actually contains. This causes the library to perform excessive iteration, leading to long processing times when opening the file. The issue is addressed in version 6.21.2.
pypdf versions prior to 6.21.2 contain a vulnerability where an attacker can craft a PDF that repeatedly references the same nonexistent indirect object. This causes repeated full-file recovery loads and long runtimes when accessing certain file parts such as pages. The issue is fixed in version 6.21.2.
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.
AWS fixed this issue service-side. No customer action is required.
Critical9.2ExploitedMirageEPSS 99%Palo Alto Unit 42CVE-2026-109618
Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP, a widely used scripting language for web servers and CMS systems. Both vulnerabilities involve improper handling of memory during fatal error processing with longjmp(), allowing attackers to execute arbitrary code remotely. CVE-2026-109618 arises from uninitialized request memory after out-of-memory errors, while CVE-2026-109619 involves global memory pointing to freed regions that can be exploited in subsequent requests. Over 22.6 million exposed instances potentially vulnerable have been identified. Palo Alto Networks provides protections through multiple security products and recommends immediate patching. At least one European government took precautionary measures by taking its website offline. Users should review the PHP Group’s security advisory for patching guidance.