Search: 18.8.3.2

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl have a vulnerability in the canonical encoding of JSON keys. The issue arises from misordering byte-string keys during UTF-16 comparison, causing inconsistent canonical documents across processes.

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl have a memory leak vulnerability. The encode_stringify function retains overloaded objects and their references without releasing them, causing unbounded memory growth when encoding such data repeatedly.

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl improperly accept malformed UTF-8 in bare hash keys when using allow_barekey in decode_hv. This causes malformed UTF-8, control bytes, and backslashes to be stored without validation, leading to errors in later operations such as case conversion or re-encoding of the hash.

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl have a vulnerability involving duplicate non-ASCII bare keys in JSON decoding. This flaw allows type confusion under the dupkeys_as_arrayref option in decode_hv, potentially causing process crashes or dereferencing arbitrary memory addresses when decoding untrusted JSON with specific relaxed options enabled.

Cpanel::JSON::XS versions before 4.80 for Perl contain a vulnerability where nested tagged values under allow_tags in decode_tag can cause stack exhaustion. This occurs because each tagged value and its content are decoded recursively without counting against max_depth, leading to unbounded recursion. An attacker can trigger an uncatchable segmentation fault by sending a crafted input with many nested tagged values, causing a denial of service.

A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 have a vulnerability in the Twig create() function where case-sensitive class-name checks allow bypass of input restrictions. This enables attackers with template-execution privileges to instantiate the SplFileObject class using a lowercase name, potentially reading sensitive .env files or writing PHP files to the webroot, leading to remote code execution.

Craft CMS versions 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 have a vulnerability in the Twig sandbox allowlist. Authenticated Control Panel users can bypass sandbox restrictions using certain filters to access sensitive information such as security keys, database credentials, and authentication tokens.

Multiple vulnerabilities were discovered in PyJWT affecting various Ubuntu LTS releases and 26.10. These include improper handling of unknown key identifiers leading to potential denial of service via request amplification, improper handling of recursively nested JSON payloads causing application failure, malformed RSA key handling causing authentication failures or denial of service, and improper validation of OKP private key components allowing misuse of stolen tokens. Fixes are available in updated package versions for affected Ubuntu releases.

CVE-2026-111755 is a high-severity vulnerability in the node-follow-redirects library, a Node.js HTTP and HTTPS client wrapper. It affects specific versions 1.2.4-1, 1.13.1-1, and 1.14.5-1. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a network attack vector with low complexity and no user interaction required. The vulnerability allows partial impact on confidentiality but no impact on integrity or availability. No public exploits or known active exploitation have been reported.

A heap buffer overflow vulnerability exists in the gpac software within the gf_odf_ac4_cfg_alternative_info function. This flaw can lead to a denial of service due to application crash. The vulnerability has a CVSS 3.1 base score of 5.5, indicating medium severity. Multiple specific versions of gpac are affected. No public exploits or patches are currently documented.

CVE-2026-111750 is a medium severity vulnerability in the Python aiohttp asynchronous HTTP client/server framework. It affects multiple specific versions of python-aiohttp. The vulnerability has a CVSS 4.0 base score of 6.3, indicating a network attack vector with low attack complexity and no user interaction required, but partial impacts on confidentiality, integrity, and availability. No public exploits or known active exploitation are reported. No patch or remediation information is provided in the available data.

CVE-2026-111749 is a low severity vulnerability affecting multiple specific versions of the Python aiohttp asynchronous HTTP client/server framework. The CVSS 4.0 score is 2.3, indicating limited impact. No public exploit or detailed technical description is provided. The affected versions are explicitly listed. No patch or remediation information is available in the provided data.

CVE-2026-111748 is a medium severity vulnerability in the Python aiohttp asynchronous HTTP client/server framework. It affects multiple specific versions of python-aiohttp. The CVSS 4.0 score is 6.3, indicating a network attack vector with low complexity but requiring partial attack prerequisites and low to low integrity and availability impacts. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the available data.

CVE-2026-111066 is a high-severity vulnerability in python-aiohttp, an asynchronous HTTP client/server framework for asyncio. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a significant impact. It affects multiple specific versions of python-aiohttp, including versions 0.17.2-1 through 3.7.4-1. No public exploits or patches are currently documented in the provided data.

CVE-2026-111065 is a medium severity vulnerability in python-aiohttp, an asynchronous HTTP client/server framework for asyncio. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network exploitable issue with low attack complexity and no privileges or user interaction required. The impact is limited to a low severity impact on availability with no confidentiality or integrity impact. Multiple specific versions of python-aiohttp are affected.

CVE-2026-111064 is a high-severity vulnerability in the Python aiohttp asynchronous HTTP client/server framework. The vulnerability affects multiple specific versions of aiohttp, as listed. It has a CVSS 4.0 base score of 8.2, indicating a significant security impact. No public exploit or known exploitation in the wild has been reported. No patch or remediation details are provided in the available data.

CVE-2026-111063 is a medium severity vulnerability affecting multiple specific versions of the Python aiohttp asynchronous HTTP client/server framework. The vulnerability has a CVSS 4.0 base score of 6.3, indicating a network exploitable issue with low complexity and no user interaction required. There is no information about active exploitation or available patches in the provided data.

A security vulnerability in GNU Emacs affects the Flymake mode, allowing for arbitrary code execution. This issue is addressed by a security update provided by Red Hat for their Enterprise Linux 9 distribution. The vulnerability is identified as CVE-2026-96442 and is rated with an important security impact by Red Hat. The update fixes the flaw in Emacs version 27.2-18.el9_8.3 and related packages. Users of Red Hat Enterprise Linux 9 are advised to apply the update to mitigate the risk.

An uncontrolled recursion vulnerability exists in the BSON decoding logic of the php-mongodb extension. This flaw can lead to a denial of service condition by causing application crashes. The vulnerability affects multiple specific versions of php-mongodb. The CVSS score is 7.5, indicating a high severity impact due to the potential for service disruption without requiring user interaction or privileges.