CVE-2026-96387 is an authentication bypass vulnerability in the Drupal Stop administrator login module affecting versions 1.0 through 1.5. The flaw allows an attacker with high privileges to bypass authentication using an alternate path or channel. The vulnerability has a low severity rating with a CVSS score of 3.8. A fix is available in version 1.6.
A missing authorization vulnerability in the Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2) allows unauthorized users to perform forceful browsing, potentially exposing sensitive information. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. There is no indication of available patches or vendor advisories at this time.
A vulnerability in Roundcube involves unsafe use of a login name in the SquirrelMail import file path, potentially allowing unauthorized access to sensitive data. The issue affects multiple specific versions of Roundcube. The CVSS score is 5.3, indicating a medium severity vulnerability with network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.
CVE-2026-114715 is an incorrect authorization vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. The flaw exists in the Modoboa driver of the password plugin, where the driver incorrectly uses the first account returned by the Modoboa API instead of verifying the authenticated user's account. This could allow a password change to be applied to a different user account.
Multiple security issues affecting the MozillaThunderbird package on openSUSE Tumbleweed have been fixed in version 153.5.1-1.1. These issues collectively represent a medium severity risk. The update addresses a range of vulnerabilities bundled in this package release.
A security update for the Linux kernel addresses multiple vulnerabilities including a NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063). The update also fixes other kernel-related security issues and bugs. The affected kernel versions are those prior to 5.14.0-687.60.1.el9_8. Red Hat has released a patch that must be applied and requires a system reboot. The update is rated as having an Important security impact by Red Hat.
CVE-2026-114574 is an information disclosure vulnerability in massCodeIO massCode version 5.10. The flaw exists in an unspecified function within the Local HTTP Service component, specifically in the file src/main/api/index.ts. This vulnerability can be exploited remotely without privileges or user interaction. Public exploit code has been disclosed. A patch identified by commit d25d8fa3f5a1e34285c8634f18729650c0c05cda is available to address the issue.
CVE-2026-14288 is a vulnerability in GitLab Enterprise Edition affecting versions from 17.4 up to but not including 19.3.6, 19.4 up to but not including 19.4.3, and 19.5 up to but not including 19.5.1. It allows an authenticated user to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-112378 is a vulnerability in GitLab EE versions from 17.8 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It involves insufficient server-side validation in billing eligibility checks, which could allow an authenticated user to access paid AI features without a valid subscription. GitLab has fixed this issue in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-112326 is a vulnerability in GitLab EE versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. It involves improper cleanup on thrown exceptions that could allow an authenticated user with read-only permissions to permanently delete existing vulnerability records. This occurs due to flawed error handling logic that fails to differentiate between pre-existing and newly created records. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
A use-after-free (UAF) vulnerability exists in PHP's session.upload_progress handler related to serialize-state cross-request handling. This vulnerability does not lead to remote code execution but can cause memory safety issues and arbitrary memory reads/writes. The vulnerability affects prefork-based PHP setups and is confirmed with a medium severity impact. A pre-patch mitigation is available by disabling session.upload_progress in PHP configuration. Official patches are expected in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.11.
CVE-2026-114383 is a critical stack-based buffer overflow vulnerability in TOTOLINK EX200 firmware version 5.2.3c.7200. It exists in the setWiFiAclAddConfig function within the wireless.so component, accessible via the /cgi-bin/cstecgi.cgi endpoint. The flaw can be exploited remotely without authentication by manipulating the macAddress parameter. Public exploit code is available, increasing the risk of exploitation.
CVE-2026-114382 is a critical stack-based buffer overflow vulnerability in TOTOLINK EX200 version 5.2.3c.7200. It occurs in the setStaticDhcpConfig function within /cgi-bin/cstecgi.cgi of the lan.so component. The flaw is triggered by manipulating the Comment argument, allowing remote attackers to execute code. Public exploit code has been released, increasing the risk of attacks.
A high-severity vulnerability (CVE-2026-114145) in python-git (GitPython) allows remote code execution due to validation of a submodule's .git path only occurring after cloning into it. This flaw affects multiple specific versions of the python-git package. The vulnerability has a CVSS score of 7.5, indicating a high impact on confidentiality, integrity, and availability. No public exploits or known in-the-wild exploitation have been reported. The vulnerability is not related to a cloud service and no patch information is provided in the data.
CVE-2026-114138 is a high severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework prior to 3.1. It has a CVSS 3.1 score of 7.5, indicating a network exploitable issue with no privileges or user interaction required, causing a high impact on availability but no confidentiality or integrity impact.
Algorithm::UrataniTakeda versions 0.1.5 through 0.1.6 for Perl contain a memory exhaustion vulnerability due to a failure shift cache that is never cleared during search operations. This cache grows with each new distinct character processed by a long-lived matcher object, potentially leading to unbounded memory consumption.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
* kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
* kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
* kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
* kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
* kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)
* kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-114136 is a high-severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework. It has a CVSS 3.1 score of 7.5, indicating high impact primarily due to availability disruption. No public exploit or known active exploitation is reported. The vulnerability does not impact confidentiality or integrity but can cause denial of service.
Apache Traffic Server contains a vulnerability that can cause it to stall a chunked transfer it processes. This issue affects multiple specific versions of the Traffic Server package. The vulnerability has a medium severity rating with a CVSS score of 5.3, indicating it can impact availability but does not affect confidentiality or integrity.
Apache Traffic Server versions including 9.2.15, 10.1.4, and 10.2.0 have a vulnerability identified as CVE-2026-111810. The issue involves an unthrottled write operation, which can lead to a high severity impact on availability. The CVSS score is 7.5, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.