LibreCAD versions through 2.2.1.6 have a heap-based out-of-bounds write vulnerability in the bundled libdxfrw library's dwgReader18::parseDataPage() function. This flaw arises from unchecked buffer sizes and page offsets when processing AC1018 (R2004) DWG files. Maliciously crafted DWG files with manipulated startOffset values can trigger heap buffer overflows during decompression, potentially causing application crashes and enabling code execution.
Semantic MediaWiki versions from 4.2.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the OptionsBuilder::profiles() function. This flaw allows users with the smw-schemaedit permission to inject malicious markup by saving specially crafted FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels. The injected scripts execute for every visitor to the Special:FacetedSearch page, including administrators, potentially compromising their sessions or data.
WWBN AVideo versions up to 29.7.1 have a missing authorization vulnerability in the Live plugin's restream endpoints. This flaw allows authenticated streamers to access other users' stream keys by manipulating live_transmitions_history_id parameters. Exploiting this, attackers can retrieve victims' HLS URLs and stream keys, enabling them to impersonate victims or restream private or pay-per-view live streams.
MQTTX desktop versions up to 1.13.3 have a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers who control an MQTT broker or publish to subscribed topics to inject malicious scripts via MQTT topic names or payloads. These scripts execute in the Electron renderer process with nodeIntegration enabled when victims hover over certain UI elements, such as Topic Tree or JSON tree nodes. The vulnerability has a CVSS score of 6.1, indicating medium severity.
WriteFreely versions before 0.17.3 are affected by a stored cross-site scripting (XSS) vulnerability. Authenticated authors can exploit this flaw by injecting malicious HTML through the post slug in the CreatePost API. This injected script executes in RSS/Atom feed readers, newsletter recipients, and ActivityPub viewers, potentially compromising confidentiality and integrity.
Multiple security vulnerabilities have been identified and addressed in the Apache HTTP Server (httpd) 2.4 packages provided by Red Hat. These include heap-based buffer overflows, NULL pointer dereferences, buffer over-reads, and denial of service issues affecting various modules such as mod_proxy_html, mod_xml2enc, mod_headers, and mod_mime. The update also includes an incomplete fix for a previous vulnerability (CVE-2023-38709). Red Hat has released security updates for Red Hat Enterprise Linux 8.8 variants to address these issues.
Red Hat OpenShift Container Platform 4.17.60 includes security updates addressing three vulnerabilities: a denial of service in Go HTTP/2 via malformed SETTINGS_MAX_FRAME_SIZE frames (CVE-2026-33814), an integrity verification bypass in the installer container downloading remote inventory scripts (CVE-2026-92092), and man-in-the-middle attacks via untrusted intermediate certificates in Go's crypto/x509 package (CVE-2026-111943). Users of OpenShift Container Platform 4.17 are advised to upgrade to these updated packages and images when available.
Multiple denial of service vulnerabilities have been identified in Wireshark protocol dissectors, including C12.22, RRC, ESS, H.245, and SPDY. These flaws could cause crashes or heap-based buffer overflows when processing specially crafted network traffic. Red Hat has issued an important security update for Wireshark in Red Hat Enterprise Linux 9 to address these issues.
Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages used in Red Hat Enterprise Linux 8 and related products. The update addresses several use-after-free vulnerabilities, denial of service issues, and other security flaws affecting kernel components such as TCP ULP support, PPP over L2TP, openvswitch, Bluetooth management, network bridging, ALSA MIDI and PCM, s390 boot parameters, and iSCSI management. These vulnerabilities have been assigned CVEs and are rated with an important security impact. The update requires a system reboot to take effect.
A denial of service vulnerability (CVE-2026-82397) exists in the python-tornado package used in Red Hat Enterprise Linux 9.6 Extended Update Support. The flaw allows denial of service via excessive URL-encoded body fields. Red Hat has issued an important security advisory with updated python-tornado packages to address this issue.
A synchronization issue in the Go standard library net/http package affects HTTP/1 servers using MaxBytesReader or MaxBytesHandler. When the MaxBytesReader limit is exceeded, the "Connection: close" header is set automatically without proper synchronization, which can race with other headers set explicitly by the server handler. This race condition can cause the server to crash due to a runtime panic if the handler reads the request body concurrently with writing the response header. Fixed versions 1.26.11 and 1.27.4 address this issue.
CVE-2026-97033 is a command injection vulnerability in the Go toolchain's cmd/go component related to the handling of cgo compiler and linker flags. Malicious packages using cgo could exploit certain flags to execute arbitrary code during build time. The vulnerability arises from unsafe use of flags such as --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x in #cgo directives. The Go project has mitigated this by disallowing or restricting these flags and verifying their usage. Fixed versions are 1.26.11 and 1.27.4.
CVE-2026-97034 is a command injection vulnerability in the Go toolchain's cmd/go component when using GCC and cgo. It arises during the linking phase if malicious GCC spec files are present, potentially allowing arbitrary command execution. The vulnerability involves unsafe evaluation of GCC link specs when certain compiler flags like -fopenmp, -fopenacc, or -fsanitize= are used. The Go toolchain has been updated to reject directories containing GCC spec files and disallow certain flag prefixes to mitigate this risk.
CVE-2026-97035 is an argument injection vulnerability in the Go toolchain's cmd/go component affecting versions before 1.26.11 and between 1.27.0-0 and 1.27.4. It arises when building malicious packages using cgo with Clang or GCC compilers. The vulnerability allows unexpected code execution at build time or writing files to arbitrary directories via certain compiler and linker flags in #cgo directives. The issue stems from improper handling of "-gen-*" and "-gnat*" flags, which were previously allowed and could desynchronize argument parsing, enabling injection of unvalidated inputs to the linker. The flags "-gen-*" and "-gnat*" are now disallowed to mitigate this risk.
A vulnerability in the Go toolchain's cmd/go on Darwin platforms allows argument injection via malicious use of cgo with specific linker flags. This can lead to arbitrary code execution due to how the Apple linker recombines separated '-l' and 'to_library' arguments into a single flag that loads an arbitrary LTO plugin dynamic library at link time. The Go toolchain has been updated to disallow these dangerous linker flags and patterns to prevent exploitation.
CVE-2026-97037 is a code injection vulnerability in the Go toolchain's cmd/go component. It arises when building a malicious package that uses cgo, allowing arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". The vulnerability involves improper handling of certain "-Wl," flags that could be interpreted as linker scripts, leading to potential code execution. The issue is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97038 is a code injection vulnerability in the Go toolchain's cmd/go component. It allows building a malicious package with specially crafted ".syso" files or cgo linker inputs that can inject arbitrary linker flags or execute code during the linking phase. The vulnerability arises because linker input files were passed to the external linker without proper validation, enabling execution of disguised linker scripts or injection of unallowlisted linker flags across multiple platforms. The issue is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97039 is an argument injection vulnerability in the Go toolchain's cmd/go component. It involves malicious packages using "#cgo pkg-config:" directives to load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The vulnerability arises from overly permissive allowlists for certain pkg-config flags and insufficient validation of flags returned by "pkg-config --cflags". The issue is addressed by disallowing specific flags and inspecting cgoCPPFLAGS for internal linking safety.
CVE-2026-97040 is a code injection vulnerability in the Go toolchain's cmd/go component. It allows an attacker to craft a ".syso" file that bypasses cgo flag validation and injects arbitrary linker flags during the linking process. This occurs because the linker incorrectly parses certain ".syso" files as Go compiler objects, allowing untrusted cgo metadata directives to be passed to the external linker without validation. The issue also involves improper handling of long ".syso" filenames, which can lose their extension and force external linking in pure-Go builds. The vulnerability is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97041 is an argument injection vulnerability in the Go toolchain's cmd/compile component. Malicious packages using certain //go:cgo_* compiler directives could inject arbitrary flags into the external linker on ELF platforms. This was due to the compiler and linker not rejecting commas in specific cgo directives, allowing crafted inputs to split linker flags and inject unintended arguments. The vulnerability also allowed overwriting of external symbol names via the two-argument form of //go:cgo_import_dynamic. The issue is fixed in Go versions 1.26.11 and 1.27.4.