A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
A vulnerability exists in GIMP where importing a crafted SBZ palette without a certain condition can cause an issue. The flaw affects multiple specific versions of GIMP and has a medium severity rating with a CVSS score of 5.5. The impact is limited to availability, with no confidentiality or integrity impact reported.
The Grav API plugin (grav-plugin-api) versions 1.0.16 through before 1.0.42 contain multiple vulnerabilities. An unauthenticated GET endpoint caches large translation dictionaries per language code, enabling resource exhaustion attacks. Additionally, versions before 1.0.42 fail to enforce page-level rules in sync and batch copy endpoints, allowing accounts with api.pages.write permission to overwrite translations or create unauthorized pages. These issues are fixed in version 1.0.42.
A heap buffer overflow vulnerability exists in the gpac software within the gf_odf_ac4_cfg_alternative_info function. This flaw can lead to a denial of service due to application crash. The vulnerability has a CVSS 3.1 base score of 5.5, indicating medium severity. Multiple specific versions of gpac are affected. No public exploits or patches are currently documented.
A segmentation violation vulnerability exists in the dump_isom_saps function of the gpac software. This flaw can cause a crash when processing certain inputs, leading to a denial of service condition. The vulnerability has a CVSS score of 5.5, indicating medium severity. It affects multiple specific versions of gpac as listed. There is no information provided about available patches or fixes.
A use-after-free vulnerability exists in the gf_filter_pid_get_packet function of the gpac software. This flaw can lead to a denial of service by causing application crashes. The vulnerability has a medium severity rating with a CVSS score of 5.5. Multiple specific versions of gpac are affected. There is no indication of known exploits in the wild or available patches at this time.
A NULL pointer dereference vulnerability exists in the avpriv_h264_has_num_reorder_frames function of libav. This flaw can cause a denial of service by crashing the application using the affected library. The vulnerability affects multiple specific versions of libav as listed.
Bulletin ID: 2026-058-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/16/2026 10:15 AM PDT Description: Bedrock AgentCore Python SDK (bedrock-agentcore) is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. We identified CVE-2026-15737 in the OpenTelemetry instrumentation of the SDK. Affected versions wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, where a local authenticated user with CloudWatch Logs read access could access the potentially sensitive content. Impacted versions: 1.4.8, 1.5.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.
canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.
The same data can encode to different canonical documents across processes.
A vulnerability in follow-redirects versions 1.16.0 to before 1.16.1 allows sensitive headers with certain metacharacters to be forwarded to attacker-controlled redirect targets due to incorrect regular expression escaping. This flaw is fixed in version 1.16.1.
CVE-2026-111750 is a medium severity vulnerability in the Python aiohttp asynchronous HTTP client/server framework. It affects multiple specific versions of python-aiohttp. The vulnerability has a CVSS 4.0 base score of 6.3, indicating a network attack vector with low attack complexity and no user interaction required, but partial impacts on confidentiality, integrity, and availability. No public exploits or known active exploitation are reported. No patch or remediation information is provided in the available data.
CVE-2026-111065 is a medium severity vulnerability in python-aiohttp, an asynchronous HTTP client/server framework for asyncio. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network exploitable issue with low attack complexity and no privileges or user interaction required. The impact is limited to a low severity impact on availability with no confidentiality or integrity impact. Multiple specific versions of python-aiohttp are affected.
Rank Math SEO PRO for WordPress experienced a supply-chain compromise affecting version 3.0.123 packages downloaded or updated between October 15 and October 16, 2026. The compromised plugin files contained malware capable of establishing persistent access, communicating with an external domain, recreating hidden backdoors, and exposing sensitive credentials. The vendor released version 3.0.124 to replace the affected packages and removed the malicious files. Sites that activated the compromised plugin during the affected window should consider themselves compromised.
An uncontrolled recursion vulnerability exists in the BSON decoding logic of the php-mongodb extension. This flaw can lead to a denial of service condition by causing application crashes. The vulnerability affects multiple specific versions of php-mongodb. The CVSS score is 7.5, indicating a high severity impact due to the potential for service disruption without requiring user interaction or privileges.
Semaphore UI versions up to 2.19.16 contain a remote code execution vulnerability. Users with the task_runner role can override protected Ansible variables by injecting arbitrary keys in the task environment JSON. This allows execution of commands as the Semaphore server user, potentially exposing sensitive data such as encryption keys, SSH keys, and stored secrets.
The Rank Math PRO WordPress plugin version 3.0.123 was compromised in a supply chain attack, with malware injected into packages distributed between October 15 and October 16, 2026. The malicious code could allow attackers to take over websites where the plugin was activated. The malware is persistent, recreating hidden backdoors and modifying files and settings to maintain access. Rank Math released a clean version 3.0.124 immediately after discovering the compromise. Users who installed or activated version 3.0.123 during the affected window should consider their sites compromised and restore from clean backups or follow detailed cleanup steps.
CVE-2026-109433 is an authorization bypass vulnerability in Camunda 7's Cockpit webapp affecting versions 7.23.0 before 7.23.17 and 7.24.0 before 7.24.16. The flaw arises from inverted comparison logic in permission checks, allowing authenticated users with minimal access to read all process instances, definitions, and incidents engine-wide without logging. This vulnerability has a medium severity score and is fixed in versions 7.23.17 and 7.24.16.
Red Hat issued a security advisory for Submariner v0.23, a Kubernetes operator enabling cross-cluster connectivity for services and pods. The advisory addresses multiple security fixes and container updates in the Submariner operator and related components. The update is rated as having an Important security impact. The advisory references several CVEs affecting the product and provides updated container images and documentation improvements. No CVSS score is provided for these vulnerabilities. The affected product is Red Hat Advanced Cluster Management for Kubernetes version 2.16. The advisory includes links to upstream Submariner release notes and Red Hat documentation for further details.
This SUSE Linux Enterprise Kernel update addresses multiple security vulnerabilities affecting various kernel components including netfilter, KVM, 9p, SCSI target, and libceph. The update fixes issues such as improper handling of Ethernet MAC headers, page overflow in SEV encryption paths, error handling in 9p client walks, buffer appending in iSCSI encoding, scratch area length calculation in KVM SEV, duplicate leaves in network shaper requests, and multiplication overflow in Ceph decoding. These fixes collectively improve kernel security and stability.
A vulnerability in VideoLAN libbluray through version 1.5.1 involves uncontrolled memory allocation. This flaw can lead to a denial of service condition due to resource exhaustion. The issue has a medium severity rating with a CVSS score of 5.5. No public exploit code or known exploitation in the wild has been reported. Multiple versions of libbluray, including various Ubuntu package versions, are affected.