CVE-2026-114138 is a high severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework prior to 3.1. It has a CVSS 3.1 score of 7.5, indicating a network exploitable issue with no privileges or user interaction required, causing a high impact on availability but no confidentiality or integrity impact.
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
CVE-2026-114136 is a high-severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework. It has a CVSS 3.1 score of 7.5, indicating high impact primarily due to availability disruption. No public exploit or known active exploitation is reported. The vulnerability does not impact confidentiality or integrity but can cause denial of service.
CVE-2026-114135 is a high-severity vulnerability affecting multiple specific versions of Jupyter Server, the backend for Jupyter web applications. The vulnerability has a CVSS 3.1 score of 8.8, indicating a network attack vector with low complexity, requiring low privileges and no user interaction, and impacts confidentiality, integrity, and availability. The affected versions include several specific builds from 1.2.2-1 through 2.20.0-3. No public exploit or known active exploitation is reported. No patch or remediation details are provided in the available data.
Apache Traffic Server contains a critical vulnerability (CVE-2026-111815) that allows TLS session resumption across different SNI virtual hosts. This flaw can lead to a complete compromise of confidentiality and integrity of TLS sessions. The vulnerability affects multiple specific versions of Traffic Server and has a CVSS score of 10.0, indicating critical severity.
CVE-2026-114139 is a critical vulnerability in the Sentry-Javascript SDK's webpack integration for @sentry/nextjs. Versions from 9.36.0 up to but not including 9.47.2, 10.0.0-alpha.0 up to 10.75.2, and 11.0.0-alpha.0 up to 11.0.0-rc.1 are affected. The issue arises when the configured tunnelRoute causes the webpack integration to skip application middleware for request paths under that route, allowing unauthenticated requests to reach protected routes if they collide with the tunnel path or a root dynamic segment. This can lead to unauthorized access when middleware is the sole authorization mechanism. The vulnerability is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.
Red Hat has issued a security advisory for php8.4 addressing multiple vulnerabilities including a denial of service via unbounded recursion in the SOAP parser (CVE-2026-91765), an out-of-memory bailout during request parsing that can lead to memory corruption and remote code execution (CVE-2026-109618), and a use-after-free condition caused by stale request state retention during fatal error handling (CVE-2026-109619). These issues affect PHP as embedded in Red Hat Enterprise Linux 10 and related variants. The update is rated as Important by Red Hat Product Security. A patch is available and should be applied to affected systems.
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.
To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
CVE-2026-112381 is a vulnerability in Apache Traffic Server that causes a crash due to a null pointer dereference. This occurs when a client POST request is half-closed while a chunked origin response is being reparsed in a reentrant write-ready callback. The issue is timing-dependent and was introduced by backports related to CVE-2021-32564. Affected versions include 9.2.15, 10.1.4, and 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-111812 is a critical authorization vulnerability in Apache Traffic Server's origin_server_auth plugin. It allows a client to force the proxy to sign attacker-chosen AWS request headers using the proxy's own credentials. This flaw affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1. The vulnerability has a CVSS score of 10.0, indicating critical severity.
Apache Traffic Server's experimental tsmemcache plugin has a critical vulnerability (CVE-2026-111811) that allows unauthenticated network users to read, write, and delete the shared proxy cache. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and exactly 10.2.0. The vulnerability is due to missing authentication for critical functions in the plugin. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 contain a vulnerability that allows HTTP request smuggling via HEAD requests with Content-Length or Transfer-Encoding headers. This flaw is addressed in versions 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server versions 9.2.15, 10.1.4, and 10.2.0 have a vulnerability where the server writes an unthrottled diagnostic log line for every internal @ header stripped from a request. This can lead to uncontrolled resource consumption when a request contains many such headers, causing excessive log data generation. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server versions 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 contain a vulnerability in the default outbound session-sharing policy. This flaw allows reuse of a pooled TLS session authenticated with one client certificate for a transaction that should present a different client certificate. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-111805 is a high-severity vulnerability in Apache Traffic Server that allows an attacker to exhaust an HTTP/1.1 origin's worker pool by sending a truncated HTTP/2 Content-Length value. This uncontrolled resource consumption can lead to denial of service conditions. The issue affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-114361 is an improper authorization vulnerability in HarnessRouter versions up to 0.31.10. It involves manipulation of the X-Harness-Org or X-Harness-Member headers in the Identity Mode component, specifically in the gateway/app.py file. The vulnerability can be exploited remotely but requires high attack complexity and is difficult to exploit. Upgrading to version 0.31.11 addresses this issue.
CVE-2026-111816 is a critical HTTP request/response smuggling vulnerability in Apache Traffic Server. The issue arises from the server forwarding a malformed 302 response that should have been rejected due to a parsing error. However, a Transfer-Encoding: chunked carve-out bypassed the rejection path, causing the server to store and serve a response that peers interpret differently. This discrepancy allows cache poisoning and response-framing desynchronization attacks. The vulnerability affects Apache Traffic Server versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
CVE-2025-55702 is a high-severity HTTP request/response smuggling vulnerability in Apache Traffic Server. It occurs when a client sends a POST request with the Expect: 100-continue header and the origin server responds before reading the request body. This causes Apache Traffic Server to misinterpret the unread body as a new request, enabling an attacker behind a shared front-end proxy to smuggle requests past the front end and desynchronize responses for other users. The vulnerability affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
Vaadin Framework 8 versions from 8.16.0 up to 8.32.1 have an improper locking vulnerability in the VaadinService.requestEnd() method. A non-numeric v-uiId request parameter triggers an exception while holding a session lock, preventing the lock from being released. This causes subsequent requests to block indefinitely and can exhaust the server's thread pool, resulting in a denial of service. No authentication beyond a session cookie is required. The vulnerability is fixed in version 8.32.2 and later. Vaadin Framework 7 and versions 10 and later are not affected.