CVE-2025-31699 is a high-severity HTTP request/response smuggling vulnerability in Apache Traffic Server. It occurs when the server returns an origin connection to the shared pool while the origin is still waiting on a request body that the client declared but never fully sent, including cases using Expect: 100-continue. This allows the origin to misinterpret subsequent requests as leftover body data, enabling attackers to smuggle requests past access controls, disrupt other users' requests, or poison the cache. The issue affects multiple versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server versions 10.0.0 through 10.1.4 and 10.2.0 contain a use-after-free vulnerability in the experimental wasm plugin's transaction-close handler. This flaw also involves forwarding unvalidated guest-supplied metric IDs to the internal stats API. The issue is resolved in versions 10.1.5 and 10.2.1.
Apache Traffic Server's experimental magick plugin contains an argument injection vulnerability (CWE-88) that allows unauthenticated clients to control ImageMagick convert arguments in its default unsigned configuration. This affects versions from 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.
Apache Pulsar contains a path traversal vulnerability in its Packages Management Service when using the filesystem storage provider. An authenticated user with package permissions on any namespace can exploit this flaw by manipulating the version component of a package name to access, overwrite, or delete packages in other tenants or namespaces. This can impact the integrity and availability of Pulsar Functions, Sources, or Sinks. The vulnerability affects deployments with package management enabled and the filesystem storage provider configured. It impacts Apache Pulsar versions from 2.10.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5.
CVE-2026-92205 is a vulnerability in BusyBox related to libarchive that allows arbitrary file creation via a symlink directory traversal. It affects multiple Ubuntu package versions of BusyBox. The vulnerability has a medium severity with a CVSS score of 6.1. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
A path traversal vulnerability (CWE-22) in Storybook development server versions from 8.0.0 up to but not including 8.6.19, 9.0.0 up to 9.1.21, 10.0.0 up to 10.6.2, and 11.0.0-alpha.0 up to 11.0.0-alpha.6 allows an attacker on the local network to obtain the WebSocket authentication token. This token can be used to invoke file-writing or testing functionality, potentially leading to code execution if the Vitest addon is installed with an old Vitest version. The issue is fixed in versions 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
CVE-2026-92207 is a high-severity code injection vulnerability in the OpenBBtable class of MindsDB version 25.10.1. It allows authenticated remote attackers to execute arbitrary Python code due to improper validation of user-supplied input. Exploitation results in code execution with the privileges of the service account running MindsDB.
CVE-2026-114125 is a code injection vulnerability in Storybook, a frontend UI component development tool. Versions from 8.0.0 up to but not including 8.6.19, 9.0.0 up to 9.1.21, 10.0.0 up to 10.6.2, and 11.0.0-alpha.0 up to 11.0.0-alpha.6 are affected. The flaw allows a malicious website to interact with the preview iframe of a running Storybook development server due to insufficient iframe embedding and message-origin restrictions. An attacker can cause unauthorized changes to story files if a developer visits and interacts with the malicious site, potentially leading to arbitrary code execution with the developer's privileges when the modified files are executed locally. Fixed versions include 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
CVE-2026-113795 is a medium severity vulnerability affecting multiple versions of pypdf2, a pure-Python PDF library. The vulnerability was published on October 23, 2026. The CVSS 4.0 score is 6.0, indicating a network attack vector with low attack complexity but requiring user interaction and partial attack complexity. The vulnerability impacts various Ubuntu package versions of pypdf2. No public exploit or known active exploitation is reported. No patch or remediation details are provided in the available data.
CVE-2026-102486 is a high-severity vulnerability in NTPsec ntpd 1.1.4 and related versions involving an out-of-bounds read during NTS extension field parsing. This flaw can cause a denial of service by crashing the ntpd process. The vulnerability does not impact confidentiality or integrity but affects availability. Multiple specific versions of NTPsec are affected.
An out-of-bounds read vulnerability exists in the Motorola Oncore refclock driver within the NTPsec software. This flaw affects multiple specific versions of NTPsec and can lead to a partial loss of availability due to the impact on system availability. The vulnerability has a medium severity rating with a CVSS score of 5.2.
A reachable exit vulnerability exists in NTPsec ntpd versions 1.1.4 through 1.2.5, allowing a remote attacker to cause a denial of service by crashing the daemon. This vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS score is 7.5, indicating a high severity level.
### Summary
Slack Morphism exposes the correct Slack request HMAC when signature verification fails.
For an invalid request, `slack-morphism` computes the correct signature for the attacker-controlled timestamp and request body and stores it in `SlackEventWrongSignatureError.generated_hash`. The error's `Debug` and `Display` representations expose that value, and the default Axum listener error handler logs it at error level.
An attacker who can both reach the application's Slack callback endpoint and read its application/service logs can therefore use the verifier as a chosen-message HMAC oracle. The attacker can send an arbitrary request with an invalid signature, recover the correct signature from the resulting log entry, and resend the same request within the five-minute freshness window. The second request passes Slack Morphism's signature verification and reaches the protected application callback without the attacker knowing the Slack signing secret.
I reproduced this end-to-end against both the Axum and Hyper integrations in `slack-morphism` 2.26.0 and 2.27.0.
### Details
The vulnerability is in Slack Morphism's request signature verification error path.
In `src/signature_verifier.rs`, `SlackEventSignatureVerifier::verify` computes the expected signature before comparing it with the untrusted `X-Slack-Signature` supplied by the request.
On a mismatch, the implementation creates a `SlackEventWrongSignatureError` containing the complete correct signature in its public `generated_hash` field.
Relevant source path:
```text
src/signature_verifier.rs:46-59
```
The error type is defined around:
```text
src/signature_verifier.rs:182-199
```
`generated_hash` is a public `String`; the type derives `Debug`, and its `Display` implementation also prints the generated signature.
The resulting source-to-sink path is:
1. `SlackEventSignatureVerifier::verify` computes the expected HMAC for the attacker-controlled timestamp and raw request body.
2. Signature verification fails because the attacker initially sends an invalid signature.
3. Slack Morphism places the correct expected value in `SlackEventWrongSignatureError.generated_hash`.
4. The error's `Debug` and `Display` representations reveal that HMAC.
5. The Axum middleware propagates/formats the error through `src/axum_support/slack_events_middleware.rs`.
6. The default listener error handler in `src/listener.rs` logs the error at error level.
7. The attacker reads the generated HMAC from the logs.
8. The attacker resends the identical timestamp and body using the disclosed value as `X-Slack-Signature`.
9. Slack Morphism accepts the request and executes the protected callback.
The Hyper path is also affected. `src/hyper_tokio/hyper_ext.rs` propagates the verifier error as a service error, and formatting that error similarly exposes the generated signature.
The disclosed value is exactly the credential required to authenticate the corresponding request:
```text
v0=hex(HMAC-SHA256(signing_secret, "v0:" || timestamp || ":" || raw_body))
```
There is no weakness in HMAC-SHA256 or the constant-time comparison itself. The vulnerability is that the expected authentication value is disclosed through the verifier's error path.
#### Affected versions
I reproduced the vulnerability against:
- `slack-morphism` 2.26.0
- `slack-morphism` 2.27.0
- current `master` at audit time:
`e3b3ecabf99dfcf6c3548a42fba89fbfa510d21c`
Git history indicates that the public `generated_hash` field was introduced in:
```text
9bf623bd51c6a9ef0cd22d842cc707a3311f1f22
```
and appears to have existed since v0.10.0. Since versions before 2.26.0 are unsupported and were not dynamically tested during this assessment, I am reporting the independently validated supported range as:
```text
>= 2.26.0, <= 2.27.0
```
No patched release is currently available.
### PoC
The PoC uses only localhost and a synthetic signing secret.
Tested environment:
```text
slack-morphism = 2.27.0
Rust 1.98.1
Linux x86_64
Axum and Hyper integrations
```
Synthetic signing secret:
```text
SLACK_MORPHISM_SYNTHETIC_SIGNING_SECRET_7c91
```
Start a Slack Morphism Axum callback endpoint using the normal Slack request signature verification middleware and the default listener error handling.
Send a request using:
```text
Body:
{"type":"attacker_chosen","action":"transfer"}
X-Slack-Request-Timestamp:
<current Unix timestamp>
X-Slack-Signature:
v0=0000000000000000000000000000000000000000000000000000000000000000
```
The all-zero signature is deliberately invalid.
#### First request
The first request is correctly rejected with HTTP 400.
However, Slack Morphism's default error output contains an entry equivalent to:
```text
SlackEventWrongSignatureError {
...
generated_hash: "v0=<correct-HMAC>"
}
```
where `<correct-HMAC>` is the valid Slack request signature for the exact attacker-controlled timestamp and body.
Copy that `generated_hash`.
Before the five-minute timestamp window expire
The golang packages provide the Go programming language compiler.
Security Fix(es):
* golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)
Bug Fix(es) and Enhancement(s):
* Update Go to version 1.26.10+1 [rhel-9.6.z] (JIRA:RHEL-287195)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-109619 is a high-severity vulnerability in PHP where internal request state can persist after its backing memory has been freed. This stale state may be used by a later request handled by the same worker before it is properly reinitialized, potentially allowing remote code execution. The issue affects multiple PHP versions across various Ubuntu releases. Official patches are available and should be applied to mitigate the risk.
A critical vulnerability in PHP (CVE-2026-109618) involves improper handling of out-of-memory conditions during request processing, which can cause PHP to crash or execute arbitrary code. This occurs because internal request data may be only partially initialized when interrupted, leading to invalid data being treated as valid during cleanup. The issue affects multiple PHP versions across various Ubuntu releases. Fixes are available and should be applied via standard system updates.