A critical buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution via a crafted Brotli-compressed stream. The issue affects all platforms and has been assigned CVE-2026-111497. Fixed versions are available, and users should update to version 1.1.4_1 or later.
Authlib versions prior to 0.23.1_2 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This flaw allows an attacker to submit a JSON Web Signature (JWS) object with an empty signatures array, which is incorrectly accepted as valid without any cryptographic verification. As a result, attacker-crafted payloads can be accepted as authenticated, leading to a complete authentication bypass. The issue is fixed in version 0.23.1_2.
Spreadsheet::XLSX versions before 0.19 for Perl contain a critical vulnerability that allows arbitrary code execution. The flaw arises from the use of string eval on number format conditions in the ExcelFmt module during XLSX file parsing. An attacker can craft a malicious XLSX file with a specially crafted number format condition to execute arbitrary Perl code when the file is parsed.
Mozilla::CA versions before 20261020 for Perl include a CA certificate bundle with a root certificate linked to compromised intermediate certificates. This bundle contains the "emSign ECC Root CA - G3" root, which enables trust paths to intermediates whose private keys are publicly known. An attacker who can intercept or redirect client traffic could use these keys to impersonate TLS servers. Perl clients using IO::Socket::SSL may fall back to this bundle if system CA stores are not used. Users should verify their CA store configuration and apply updates from their OS vendor if relying on the system store.
Text::CSV_XS versions before 1.65 for Perl have a vulnerability where parsing input that ends with a separator and a lone carriage return (CR) results in an unexpected 0xFF byte being returned for an empty last field. This malformed byte can cause issues in applications processing CSV data, especially with UTF-8 flagged input. The issue occurs when reading CRLF files line by line and the last column is empty, causing the application to receive a byte not present in the original input.
Text::CSV_XS versions before 1.65 for Perl contain a vulnerability where numeric strings with leading or trailing whitespace can be written without quotes, causing record splitting. This occurs because the combine and print functions do not verify if a field requires quotes when its value has Perl's numeric flag set. As a result, a numeric value containing a newline can prematurely end a CSV record and cause subsequent fields to be interpreted as a new row.
Text::CSV_XS versions before 1.65 for Perl have a vulnerability where the end of a record and its line ending are dropped when a UTF-8 flagged field precedes invalid UTF-8 bytes during print operations. This causes the next record to be written on the same line or misinterpreted as part of the previous field due to missing closing quotes.
Text::CSV_XS versions from 1.46 up to but not including 1.65 for Perl contain a use-after-free vulnerability in the handling of bind_columns variables when skip_empty_rows skips an empty line in getline. This can cause the application to use freed memory and potentially crash.
Pillow's multi-frame image loaders can reuse stale native image storage when switching image modes between frames, leading to native out-of-bounds writes, crashes, and potential command execution. This occurs because the native storage allocated for one frame is retained and reused for a later frame with a different mode without proper validation. Affected image formats include PSD, MPO/JPEG, DCX, and MIC. The vulnerability allows denial of service and, in some cases, command execution in specific runtime profiles. The issue was confirmed in Pillow 12.3.0.