Multiple vulnerabilities were discovered in PyJWT affecting various Ubuntu LTS releases and 26.10. These include improper handling of unknown key identifiers leading to potential denial of service via request amplification, improper handling of recursively nested JSON payloads causing application failure, malformed RSA key handling causing authentication failures or denial of service, and improper validation of OKP private key components allowing misuse of stolen tokens. Fixes are available in updated package versions for affected Ubuntu releases.
CVE-2026-111755 is a high-severity vulnerability in the node-follow-redirects library, a Node.js HTTP and HTTPS client wrapper. It affects specific versions 1.2.4-1, 1.13.1-1, and 1.14.5-1. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a network attack vector with low complexity and no user interaction required. The vulnerability allows partial impact on confidentiality but no impact on integrity or availability. No public exploits or known active exploitation have been reported.
A heap buffer overflow vulnerability exists in the gpac software within the gf_odf_ac4_cfg_alternative_info function. This flaw can lead to a denial of service due to application crash. The vulnerability has a CVSS 3.1 base score of 5.5, indicating medium severity. Multiple specific versions of gpac are affected. No public exploits or patches are currently documented.
CVE-2026-111750 is a medium severity vulnerability in the Python aiohttp asynchronous HTTP client/server framework. It affects multiple specific versions of python-aiohttp. The vulnerability has a CVSS 4.0 base score of 6.3, indicating a network attack vector with low attack complexity and no user interaction required, but partial impacts on confidentiality, integrity, and availability. No public exploits or known active exploitation are reported. No patch or remediation information is provided in the available data.
CVE-2026-111749 is a low severity vulnerability affecting multiple specific versions of the Python aiohttp asynchronous HTTP client/server framework. The CVSS 4.0 score is 2.3, indicating limited impact. No public exploit or detailed technical description is provided. The affected versions are explicitly listed. No patch or remediation information is available in the provided data.
CVE-2026-111748 is a medium severity vulnerability in the Python aiohttp asynchronous HTTP client/server framework. It affects multiple specific versions of python-aiohttp. The CVSS 4.0 score is 6.3, indicating a network attack vector with low complexity but requiring partial attack prerequisites and low to low integrity and availability impacts. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the available data.
CVE-2026-111066 is a high-severity vulnerability in python-aiohttp, an asynchronous HTTP client/server framework for asyncio. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a significant impact. It affects multiple specific versions of python-aiohttp, including versions 0.17.2-1 through 3.7.4-1. No public exploits or patches are currently documented in the provided data.
CVE-2026-111065 is a medium severity vulnerability in python-aiohttp, an asynchronous HTTP client/server framework for asyncio. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network exploitable issue with low attack complexity and no privileges or user interaction required. The impact is limited to a low severity impact on availability with no confidentiality or integrity impact. Multiple specific versions of python-aiohttp are affected.
CVE-2026-111064 is a high-severity vulnerability in the Python aiohttp asynchronous HTTP client/server framework. The vulnerability affects multiple specific versions of aiohttp, as listed. It has a CVSS 4.0 base score of 8.2, indicating a significant security impact. No public exploit or known exploitation in the wild has been reported. No patch or remediation details are provided in the available data.
CVE-2026-111063 is a medium severity vulnerability affecting multiple specific versions of the Python aiohttp asynchronous HTTP client/server framework. The vulnerability has a CVSS 4.0 base score of 6.3, indicating a network exploitable issue with low complexity and no user interaction required. There is no information about active exploitation or available patches in the provided data.
A security vulnerability in GNU Emacs affects the Flymake mode, allowing for arbitrary code execution. This issue is addressed by a security update provided by Red Hat for their Enterprise Linux 9 distribution. The vulnerability is identified as CVE-2026-96442 and is rated with an important security impact by Red Hat. The update fixes the flaw in Emacs version 27.2-18.el9_8.3 and related packages. Users of Red Hat Enterprise Linux 9 are advised to apply the update to mitigate the risk.
An uncontrolled recursion vulnerability exists in the BSON decoding logic of the php-mongodb extension. This flaw can lead to a denial of service condition by causing application crashes. The vulnerability affects multiple specific versions of php-mongodb. The CVSS score is 7.5, indicating a high severity impact due to the potential for service disruption without requiring user interaction or privileges.
Node anymatch versions 1.3.0-1 are affected by a regular expression denial of service (ReDoS) vulnerability in the Picomatch library through version 4.0.7. This vulnerability can cause high impact availability issues by exhausting system resources when processing crafted regular expressions.
sqlparse versions up to 0.6.0 contain a PHP code injection vulnerability that can lead to high impact on confidentiality and integrity with limited availability impact. The vulnerability has a CVSS score of 7.3 and affects multiple specific versions primarily distributed in Ubuntu packages. No public exploits or patches are currently indicated.
A vulnerability in VideoLAN libbluray through version 1.5.1 involves uncontrolled memory allocation. This flaw can lead to a denial of service condition due to resource exhaustion. The issue has a medium severity rating with a CVSS score of 5.5. No public exploit code or known exploitation in the wild has been reported. Multiple versions of libbluray, including various Ubuntu package versions, are affected.
rdesktop versions up to and including 1.9.0 contain a heap out-of-bounds read vulnerability. This flaw can cause a denial of service by crashing the affected application. The vulnerability has a CVSS v3.1 score of 6.5, indicating a medium severity level. No public exploit code or active exploitation in the wild has been reported. The affected versions include multiple builds of 1.8.3, 1.8.6, and 1.9.0.
rdesktop versions up to 1.9.0 contain a heap out-of-bounds read vulnerability. This flaw can cause a denial of service by crashing the affected application. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No public exploits or known active exploitation have been reported. The affected versions include multiple builds of 1.8.3, 1.8.6, and 1.9.0.
Netpbm versions through 11.16.00 contain a heap out-of-bounds read vulnerability. This flaw can lead to a denial of service due to application crashes. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. It requires local access with low attack complexity and no privileges, but user interaction is needed to trigger the issue.
libtins versions up to 4.6 contain an out-of-bounds read vulnerability in the DNS component. This flaw can cause a low-severity impact, specifically a denial of service due to application crash or instability. The vulnerability has a CVSS score of 3.7, indicating low severity. No public exploits or known active exploitation have been reported. The affected versions include specific builds from 3.4-2 through 4.5-1.1build1.
libtins versions up to 4.6 contain a heap out-of-bounds read vulnerability that can cause a denial of service by crashing the application. The vulnerability has a medium severity with a CVSS score of 5.3 and does not impact confidentiality or integrity.