A reference leak vulnerability exists in the items-view union and subtraction operators of aio-libs/multidict versions 6.7.0 through 6.9.0. This flaw causes unbounded memory growth when processing attacker-controlled HTTP headers or query strings, as certain object references are not properly released. The leak results from a coding oversight where new references to key-identity and value objects are created but never decremented, leading to memory that cannot be reclaimed by garbage collection. This issue was introduced due to a change in ownership semantics between versions 6.6.4 and 6.7.0. The vulnerability is fixed in version 1.6.0 of the affected product modal, which uses multidict.
Quasar Framework versions prior to 3.3.0 contain a cross-site scripting (XSS) vulnerability due to improper neutralization of input during server-side rendering and static site generation. The vulnerability arises when the ssrContext.nonce value is interpolated directly into quoted HTML attributes without proper sanitization, allowing an attacker to inject malicious markup if they can control or override this value. This issue is fixed in version 3.3.0.
Attackers who obtain AWS credentials are actively validating them to determine their usefulness for accessing Amazon Bedrock services. Credential harvesting platforms, including KMON_NOC, test stolen AWS keys by calling GetCallerIdentity, then verifying Bedrock access through ListFoundationModels and Converse API calls. This validation enables attackers to assess the value of credentials for resale in token-jacking markets, where stolen AI model access is sold below retail price. The testing targets Anthropic Claude models and enumerates promotional credits to estimate financial worth. This behavior represents an evolution in credential validation techniques similar to those previously observed with AWS SES and SNS services.
### Summary
A DOM Clobbering vulnerability exists in Quasar's `openURL()` utility when handling the iOS `SafariViewController` bridge.
The vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `<a id="SafariViewController">` can cause the browser to expose that element as `window.SafariViewController`.
When `openURL()` is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:
```
TypeError: window.SafariViewController.isAvailable is not a function
```
This can cause client-side denial of service and break navigation-related workflows in Quasar applications.
### Details
Quasar provides the `openURL()` utility to open external URLs. On iOS platforms, this utility supports integration with the native `SafariViewController` bridge.
The vulnerable code is located in:
```
ui/src/utils/open-url/open-url.js
````
The affected logic is:
```javascript
if (Platform.is.ios && window.SafariViewController !== void 0) {
window.SafariViewController.isAvailable(available => {
if (available) {
window.SafariViewController.show({ url }, noop, reject)
}
})
}
````
The issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions.
Modern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as:
```html
<a id="SafariViewController"></a>
```
can cause:
```javascript
window.SafariViewController
```
to resolve to an `HTMLAnchorElement` instead of the expected native bridge object.
When Quasar later executes:
```javascript
window.SafariViewController.isAvailable(...)
```
the DOM element is incorrectly treated as the bridge object, causing:
```
TypeError: window.SafariViewController.isAvailable is not a function
```
The root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects.
The vulnerability was verified through the Quasar `QEditor` rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the `SafariViewController` named element, subsequent calls to `openURL()` fail.
Additional component-level affected paths were identified in `QSelect` and `QChatMessage` when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction.
### PoC
#### Steps to reproduce
1. Render attacker-controlled HTML content through a Quasar HTML rendering component such as `QEditor`.
2. Insert the following payload:
```html
<a id="SafariViewController" href="#bridge">
SafariViewController
</a>
````
3. Verify that the browser exposes the element as a global property:
```javascript
window.SafariViewController
```
The value resolves to the injected DOM element instead of the expected native bridge object.
4. Trigger a normal workflow that invokes:
```javascript
openURL('https://example.com')
```
5. Observe the browser console output:
```
TypeError: window.SafariViewController.isAvailable is not a function
```
The URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element.
The same underlying issue can also affect other HTML rendering paths such as `QSelect` and `QChatMessage` when attacker-controlled HTML is rendered and the application later calls `openURL()`.
### Impact
This vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS `SafariViewController` integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar's `openURL()` functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution.
Potentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality.
The confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered `SafariViewController` object, preventing the expected URL opening behavior.
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
libmikmod versions before 3.3.14 contain an integer overflow vulnerability in the Oktalyzer loader function OKT_doPBOD(). This flaw allows attackers to craft OKT module files with manipulated track counts that cause a heap buffer overflow. The vulnerability arises from a 16-bit track count value (numtrk) wrapping due to an overflow in the SLEN chunk, leading to out-of-bounds writes. Exploitation can result in application crashes or potential code execution.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does not bound the combined size of repeated headers.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Jisung Chae for reporting this issue.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is subject to
a potential denial-of-service attack when processing many distinct, very long
language codes, which are retained as keys in an in-memory cache and
consume process memory.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Gleb Lizunov for reporting this issue.
A vulnerability in the Linux kernel's wifi subsystem (cfg80211) was fixed by adding a check on the IP header size in the function cfg80211_classify8021d(). The issue involved processing frames that appeared to be IP packets but were too short, causing incorrect reading of the DS field and resulting in uninitialized value usage.
A vulnerability in the Linux kernel TCP stack allows setting tcp_rmem values below 4096, which can cause a division-by-zero error leading to a kernel crash. This occurs because the receive buffer space can be initialized to zero, triggering a divide error in tcp_rcvbuf_grow(). The issue arises from tcp_rmem allowing arbitrarily small values, unlike other buffer settings that enforce minimums. The fix enforces a minimum tcp_rmem value of 4096 to prevent this condition.
A vulnerability in the Linux kernel's mhi_wwan_mbim driver occurs because it does not check the return value of skb_copy_bits() when copying datagrams from the NTB. This can lead to passing uninitialized kernel memory to the network stack, causing kernel heap memory leakage. The issue is fixed by properly handling the copy failure, freeing the skb, and counting the error.
A vulnerability in the Linux kernel's net/sched subsystem (hhf qdisc) allows unbounded memory allocation due to an unchecked hh_flows_limit value during qdisc change operations. This can lead to excessive memory consumption under spoofed traffic conditions. The issue arises because the hh_flows_limit attribute was not properly bounded, allowing attackers with CAP_NET_ADMIN in a user namespace to set extremely high limits. The flaw has been addressed by bounding hh_flows_limit to twice the default value and ensuring the default is correctly applied during initialization.
CVE-2026-98222 is a high-severity vulnerability in the Linux kernel's KEYS encrypted subsystem. It involves an integer overflow in the datablob_len parameter used in encrypted_key_alloc(), which stores this length in a 16-bit unsigned integer. If the computed length exceeds the maximum value for a u16, the allocation size is truncated, leading to a slab-out-of-bounds write when copying the master key description. This flaw can cause memory corruption. The vulnerability has been addressed by adding overflow checks and using safer memory allocation methods.
CVE-2026-98184 is a vulnerability in the Linux kernel's mwifiex wireless driver where improper handling of authentication frame length can lead to a heap buffer overflow. The flaw arises because the combined length of authentication data can exceed the maximum value storable in a 16-bit field, causing truncation and subsequent buffer overflow during data copy. Exploitation requires CAP_NET_ADMIN privileges and a suitable network environment. The issue has been resolved by validating length values before assignment.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing, specifically in the IDENTIFIER and VALUE sub-patterns. The regex uses adjacent quantified groups over overlapping character classes, causing quadratic backtracking on failing matches. This can be exploited by an attacker supplying a crafted CSS selector string, causing the parser to stall for seconds or minutes depending on input size. The vulnerability affects applications using user-controlled selectors with soupsieve or BeautifulSoup's select methods. Fixed in soupsieve version 0.20.1_1.