A DLL loading vulnerability exists in the TeamViewer Remote Management Monitoring installer for Windows versions prior to 26.10.1. This flaw allows a local authenticated user with low privileges to execute arbitrary code with elevated privileges, but requires user interaction to exploit.
A double free vulnerability exists in the XKB SetGeometry function in X.Org X Server versions before 21.1.25 and X Wayland versions before 24.1.14. This flaw could allow attached clients to cause a crash or potentially execute code within the X server context. The vulnerability affects multiple Ubuntu package versions of xorg-server. It has a high severity rating with a CVSS score of 7.8.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
CVE-2026-57188 is a high-severity stack buffer overflow vulnerability in the res_xmpp module of Asterisk, an open source telephony toolkit. It affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and certain Certified Asterisk releases. An authenticated attacker with an XMPP account on the same or federated server can exploit this by sending crafted packets to cause out-of-bounds writes. The vulnerability requires the res_xmpp module to be loaded and an XMPP connection configured. Fixed versions are available.
CVE-2026-116649 is a high-severity vulnerability in Tanium Enforce involving improper neutralization of formula elements in CSV files. This flaw relates to insufficient output sanitization, which could allow an attacker to inject malicious formulas into CSV exports. Tanium has addressed this issue in versions 2.9.736, 2.10.778, and 3.0.373.
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* libexpat: denial of service via crafted XML input (CVE-2026-45186)
Bug Fix(es) and Enhancement(s):
* Thunderbird ESR 153 rebase [rhel-10.2.z] (JIRA:RHEL-175207)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This Red Hat security advisory addresses multiple vulnerabilities in the Go programming language toolset (golang) provided in Red Hat Enterprise Linux 8.4. The update includes fixes for a range of security issues such as sensitive headers being sent after cross-domain redirects, timing side channels, certificate validation errors, denial of service via various crafted inputs, privilege escalation via Punycode processing, cross-site scripting, and memory corruption. The advisory updates Go to version 1.26.10 and includes bug fixes and enhancements. The vulnerabilities affect core Go packages including net/http, crypto/x509, crypto/tls, net/mail, and others.
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.
CVE-2026-57201 is a high-severity stack buffer overflow vulnerability in the Asterisk telephony toolkit's H.323 chan_ooh323 addon channel driver. It arises from an unbounded vsprintf write into a fixed 2048-byte buffer in the ooTrace() trace-logging function. This can cause the Asterisk process to crash when processing a crafted packet. The vulnerable chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. The issue is fixed in multiple Asterisk releases including 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk versions 20.7-cert11 and 22.8-cert3.
CVE-2026-114598 is a high-severity vulnerability in EPICS Base versions up to and including 7.0.10. It involves insufficient validation of element or length values in network messages, which can cause the application to read beyond allocated buffer bounds. This flaw can lead to denial of service and potential exposure of adjacent memory contents.
CVE-2026-114597 affects EPICS Base versions up to and including 7.0.10. It involves improper validation of element or length values in network messages, which can cause the application to read beyond allocated buffer boundaries. This vulnerability may lead to denial of service and potential exposure of adjacent memory contents.
CVE-2026-114596 is a high-severity integer overflow vulnerability in EPICS Base versions up to and including 7.0.10. The flaw arises from improper validation of message length values during protocol parsing, which can lead to an integer overflow and subsequent out-of-bounds memory write. Exploitation may cause process instability or denial of service conditions.
CVE-2026-114595 is a critical integer overflow vulnerability in EPICS Base versions up to 7.0.10. The flaw occurs during network request processing, causing memory to be allocated with an incorrect size. This can lead to memory corruption, denial of service, or potentially remote code execution if attacker-supplied data is handled improperly.
CVE-2026-57198 is a heap-based buffer overflow vulnerability in the Asterisk telephony toolkit affecting the chan_sip channel driver when the textsupport option is enabled. An authenticated attacker can exploit this flaw by sending crafted T.140 RED packets, potentially causing remote code execution or crashing the system. The chan_sip driver is deprecated in Asterisk 20 and removed in later versions. Fixes are available in multiple Asterisk versions including 20.20.1, 21.12.3, 22.10.1, and 23.4.1.
CVE-2026-57185 is a buffer over-read vulnerability in the PJSIP MWI body parser of Asterisk, an open source telephony toolkit. An authenticated attacker can cause a crash by sending a crafted SIP NOTIFY request. Authentication can be via username/password or source IP address matching. The issue affects multiple versions prior to fixed releases and has been addressed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and corresponding Certified Asterisk releases.
CVE-2026-57197 is a heap-based buffer overflow vulnerability in Asterisk's handling of OGG/Speex audio packets. It occurs due to an unbounded memcpy operation in the format_ogg_speex component when processing corrupted Speex audio files. An attacker must supply a crafted file and have it played by Asterisk, requiring elevated privileges or administrator cooperation. This flaw can cause Asterisk to crash. Fixed versions include Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases.
Red Hat has issued a security advisory for the pki-deps:10.6 module in Red Hat Enterprise Linux 8 addressing multiple denial of service vulnerabilities in the Jackson JSON processing libraries. The vulnerabilities include unbounded StringBuilder growth during malformed token processing, quadratic forward-reference completion, and excessively long JSON property names. These flaws could be exploited to cause denial of service conditions in applications using these libraries.
PhpSpreadsheet versions from 5.5.0 up to and including 5.9.0 contain a server-side request forgery (SSRF) vulnerability in the Worksheet\Drawing::setPath() method. The vulnerability arises because the external image URL whitelist check is applied only once on the initial URL, and HTTP redirects are followed without re-validation, allowing an attacker to redirect requests to internal or otherwise restricted endpoints. This results in a blind SSRF where the server issues internal GET requests without exfiltrating response content. A fix is available in version 5.10.0.
PhpSpreadsheet's ODS reader has an unbounded number-rows-repeated attribute handling flaw that can cause memory exhaustion. When processing an OpenDocument Spreadsheet (.ods) file, the reader expands the number-rows-repeated attribute without an upper bound, potentially materializing millions of cells from a small file. This leads to PHP fatal out-of-memory errors. All maintained versions up to 5.9.0 are affected. The vulnerability is fixed in versions 5.10.0, 3.10.8, 2.4.8, 2.1.19, and 1.30.7.