PipeWire versions prior to 0.3.63-7.oe2403sp3 contain a vulnerability involving multiple unbounded alloca() calls in the PulseAudio protocol server. This flaw allows an attacker with minimal permissions inside a sandboxed environment, such as Flatpak, to escape the sandbox by loading a malicious library via PipeWire's PulseAudio compatibility layer. Successful exploitation can lead to arbitrary code execution outside the sandbox and full compromise of the user's system.
A shell command injection vulnerability exists in libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 when built with the libssh2 SSH backend. The vulnerability allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path with unescaped shell metacharacters. This occurs due to improper escaping in the gen_proto() function, which inserts the repository path directly into a shell command string. The issue can be triggered by crafting a malicious submodule URL in a .gitmodules file during a recursive clone operation.
A vulnerability in GNU patch allows an attacker to create arbitrary files outside the intended directory by using a specially crafted patch file. This occurs due to missing validation of absolute file paths during automatic patch reversal, enabling file creation with the permissions of the executing user. The flaw affects versions prior to 2.7.6-24.oe2403sp4 and has a medium severity rating.
Libwebsockets versions prior to 4.3.0-12.oe2203sp4 contain an out-of-bounds read vulnerability in the LEJP incremental parser that can be exploited remotely to cause a denial of service. This vulnerability is identified as CVE-2026-95114 and is rated high severity with a CVSS score of 7.5. A patch is available in version 4.3.0-12.oe2203sp4 that addresses this issue.
CVE-2026-109089 is a high-severity vulnerability affecting libXi, the client-side library for the X Input Extension. Multiple security issues were identified in the X.Org client library implementations, prompting security fixes. The vulnerability impacts versions of libXi prior to 1.8.1-6.oe2403sp1. The CVSS 3.1 score is 7.5, indicating high impact on confidentiality, integrity, and availability. A patch is available in version 1.8.1-6.oe2403sp1.
Squid proxy server versions from 3.3.0.1 up to but not including 7.6 are vulnerable to an HTTP Request Smuggling attack due to improper enforcement of HTTP/1.1 Transfer-Encoding header parsing. This flaw allows a trusted client to bypass security controls and potentially poison upstream HTTP caches with malicious content. The vulnerability is fixed in Squid version 7.6.
CVE-2026-95838 is a vulnerability in containerd, an industry-standard container runtime. Prior to versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5, the layer unpack handler in containerd repeatedly traverses directories when processing certain opaque whiteout configurations. A malicious image layer can exploit this to cause repeated directory traversals, leading to high CPU usage, delayed container startup, and reduced image-pull concurrency for unrelated deployments. This issue has been fixed in the specified versions.
Libsndfile version prior to 1.0.31-7.oe2203sp4 contains a vulnerability in the psf_binheader_readf() function when parsing WAV fmt chunks. This flaw involves a misaligned memory access that can cause undefined behavior and lead to a denial of service when processing specially crafted WAV files. The issue is fixed in version 1.0.31-7.oe2203sp4.