CVE-2026-101296 is a critical vulnerability in Apache Tomcat 6 and 7 versions that involves a missing critical step in the authentication process. This flaw allows an attacker to potentially bypass authentication controls, leading to high-impact security risks. The vulnerability has a CVSS 4.0 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. It affects multiple specific versions of Tomcat 6.0.37 through 7.0.52, including various Ubuntu package builds. No public exploits or known in-the-wild exploitation have been reported yet. No patch or remediation information is provided in the available data, so patch status is not confirmed.
CVE-2026-101356 is a critical vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets. It involves incorrect object recycling and reuse, which can cause request and response mix-ups between users. This flaw affects Apache Tomcat versions 9.0.118 through 9.0.122, 10.1.55 through 10.1.60, and 11.0.22 through 11.0.26. The issue is resolved in versions 9.0.123, 10.1.61, and 11.0.27.
The PyPI package 'resion' version 22.0.1 contains malicious code embedded in a dependency named 'pafex'. This dependency loads a disguised pickle file that executes malicious code upon unpickling. The malicious payload establishes persistence on the victim's machine via a PTH file and downloads a secondary payload. The campaign associated with this package involves file exfiltration, obfuscation, remote command execution, and remote access trojan (RAT) behavior. The final remote payload observed was a stub, indicating potential further stages. No patch or fix information is provided.
CVE-2026-113399 is a vulnerability in the mozjs52 JavaScript engine related to incorrect boundary conditions in the SVG component. This flaw was addressed and fixed in Firefox version 158.0.1 and Thunderbird 158.0.1. The vulnerability has a medium severity impact as assessed by the source data. There are no known exploits in the wild for this issue. The vendor advisory confirms the fix and provides no indication that further mitigation steps are required beyond updating to the fixed versions.
A denial of service vulnerability exists in libexpat versions 2.7.2 through 2.9.0 due to improper handling in the XML_ParserReset function. This function zeroes the direct byte count but does not offset tracked heap allocations, allowing an attacker to cause subsequent XML parsing operations to fail with an out-of-memory error until the parser is recreated.
CVE-2026-110095 is a low-severity vulnerability affecting specific versions of the node-ajv package, related to the fast-uri dependency, which is an RFC 3986 URI parser and serializer. The vulnerability has a CVSS score of 3.7 with no confidentiality or availability impact, only limited integrity impact. No known exploits are reported in the wild.
UnRTF by the GNU Project contains an out-of-bounds write vulnerability identified as CVE-2026-109831. This flaw can be triggered when a user processes crafted input, potentially leading to limited integrity and availability impacts. The vulnerability has a medium severity rating with a CVSS score of 5.4. Multiple specific versions of UnRTF are affected.
compress-lzf versions 1.0.3-1, 1.0.4-1, and 1.0.4-1build1 contain an out-of-bounds memory access vulnerability. This flaw can lead to a critical impact including high confidentiality loss and high availability impact. The vulnerability is identified as CVE-2026-109395 and has a CVSS score of 9.1, indicating a critical severity level.
CVE-2026-112901 is a medium severity vulnerability in the Pillow Python imaging library affecting versions prior to 13.0.0. The issue relates to the handling of XBM image headers. It has a CVSS 4.0 base score of 6.9, indicating a network exploitable vulnerability with low attack complexity and no required privileges or user interaction. No public exploits or known active exploitation have been reported. The affected versions include various Ubuntu package builds of Pillow up to version 3.0.0-1build1.
A critical vulnerability (CVE-2026-112900) affects the Pillow Python imaging library versions from 2.6.0 up to but not including 13.0.0. The vulnerability has a high CVSS 4.0 score of 9.2, indicating severe impact with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Specific technical details and exploit methods are not provided in the available data.
A medium severity vulnerability (CVE-2026-112898) affects the Pillow Python imaging library versions from 9.1.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network exploitable issue with low impact on confidentiality. No public exploits or known active exploitation have been reported. The affected versions include various Ubuntu package builds of Pillow. No patch or remediation details are provided in the available data.
A high-severity vulnerability (CVE-2026-112897) affects the Pillow Python imaging library versions from 5.3.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The flaw allows for a high impact on confidentiality without requiring privileges or user interaction. Multiple Ubuntu package versions are listed as affected. No public exploits or vendor patch information are provided in the data.
CVE-2026-112896 is a high-severity vulnerability in the Pillow Python imaging library affecting TIFF encoding prior to version 13.0.0. The flaw allows an attacker to cause a high-impact security issue without requiring privileges or user interaction. Multiple Ubuntu package versions of Pillow are affected.
A high-severity vulnerability (CVE-2026-112895) affects the Pillow Python imaging library versions from 5.1.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The affected versions include multiple Ubuntu package builds of Pillow. No public exploits or vendor patch information are provided in the data.
A high-severity vulnerability (CVE-2026-112894) affects the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant security risk. The flaw allows for a high impact without requiring privileges or user interaction. Multiple Ubuntu package versions of Pillow are affected. No public exploits or patches are currently documented in the provided data.
A high-severity vulnerability (CVE-2026-112893) affects the Pillow Python imaging library versions from 10.0.0 up to 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a network exploitable issue with high impact. The affected versions include several Ubuntu package builds of Pillow. No public exploits or vendor patch information are provided in the data.
Pillow, a Python imaging library, contains a high-severity vulnerability affecting versions from 4.1.0 up to 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. Specific details about the nature of the vulnerability are not provided in the available data. Multiple Ubuntu package versions are listed as affected. No public exploits or known active exploitation have been reported. Patch status is not confirmed due to lack of vendor advisory or patch information.
A medium severity vulnerability (CVE-2026-112891) affects the Pillow Python imaging library versions from 9.2.0 up to but not including 13.0.0. The CVSS 4.0 base score is 6.9, indicating a network exploitable issue with low impact on availability and no user interaction required. Specific technical details and impact vectors are limited in the provided data.
A critical vulnerability exists in Pillow, a Python imaging library, affecting versions prior to 13.0.0. The issue relates to the JPEG decoder component. The vulnerability has a high CVSS 4.0 score of 9.2, indicating significant potential impact. No public exploits or detailed technical descriptions are provided. The affected versions include multiple Ubuntu package builds of Pillow from 2.2.1 through 3.0.0. No patch or remediation details are included in the data.