A resource exhaustion vulnerability exists in opentelemetry-python prior to version 1.45.1. The TraceState.from_header function parses W3C tracestate headers using an unbounded optional-whitespace regular expression, which can cause excessive CPU usage when processing a malformed header with a long sequence of spaces or tabs. This can impact availability by consuming excessive CPU resources, potentially delaying or blocking other requests in synchronous or asynchronous environments. The vulnerability does not expose or modify telemetry data and does not allow code execution. The issue is fixed in version 1.45.1.
An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailability of workflow execution functionality. A workaround is not possible.
Next.js versions from 13.0.0 up to but excluding 15.5.28, and from 16.0.0 up to but excluding 16.4.1, contain a vulnerability where crafted requests targeting App Router applications with Server Actions can cause excessive CPU usage and block further request processing in the same process. Applications using the Pages Router or App Router without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.
CVE-2026-115453 is an authorization bypass vulnerability in the MarcosCamara01 Ecommerce Template affecting the cart and wishlist repositories. It allows any authenticated user to delete or modify cart and wishlist entries of other users due to improper enforcement of PostgreSQL row level security (RLS). The application connects as the table owner, bypassing RLS policies that rely on user ID checks. Sequential identifiers enable enumeration of other users' cart and wishlist items, leading to unauthorized data modification or deletion.
CVE-2026-115450 is a vulnerability in the MarcosCamara01 Ecommerce Template that allows an authenticated user without special privileges to manipulate the checkout process. The flaw arises because the cart API accepts separate parameters for the product variant and the Stripe price ID without verifying their consistency. This enables an attacker to pay the price of one product while ordering a different, potentially more expensive product. The vulnerability allows repeated exploitation to purchase goods at the price of the cheapest item in the catalogue, causing order records to mismatch the actual payment amount.
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.
Multiple security vulnerabilities affecting the buildah package in Red Hat Enterprise Linux 9 have been identified and fixed. These include denial of service issues in several Go packages (net/http, encoding/asn1, net/url, crypto/tls) and a cross-site scripting vulnerability in Go html/template. The update improves the security of container image building and handling by addressing these issues.
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users' computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.
CVE-2026-61791 is a stored cross-site scripting (XSS) vulnerability in schorschii OCO-Server prior to version 1.2.1. The vulnerability arises from improper neutralization of script in HTML attributes, specifically in the Html::commandButton() function, which embeds a stored computer hostname into a JavaScript inline onclick handler with insufficient escaping. An attacker with access to the shared agent-registration-key and with self-registration enabled can inject malicious script via a crafted hostname. This script executes in an administrator's authenticated session when activating certain command buttons, potentially allowing abuse of administrative privileges such as deploying software jobs. The issue is fixed in version 1.2.1.
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10
Flexible GraphRAG versions from 0.6.0 up to but not including 0.8.2 contain an improper encoding vulnerability in the _escape() helper function. This flaw allows crafted input to inject malicious Cypher clauses that can modify or delete graph data and potentially disclose sensitive information when query results are surfaced. The vulnerability arises from incorrect escaping order and unsafe insertion of dynamic identifiers into Cypher queries. The issue is fixed in version 0.8.2.
BusyBox httpd contains a vulnerability where IP deny rules with invalid CIDR prefix lengths fail open, resulting in a parsed IP with a zeroed mask that matches no clients. This issue affects multiple BusyBox versions including various Ubuntu and Red Hat Hardened Images releases. The vulnerability has a CVSS score of 5.3 (medium severity). Red Hat has released updated BusyBox packages (version 1.37.0-9.1.hum1) addressing this and related CVEs.
A high severity vulnerability identified as CVE-2026-19553 affects multiple python3.13 related packages in Red Hat Hardened Images RPMs for aarch64 and x86_64 architectures. Red Hat has issued a security advisory with updated package versions to address this vulnerability. The advisory includes python3.13 packages updated to version 3.13.15-1.4.hum1. The vulnerability relates to CWE-297 and has a CVSS vector indicating network attack vector, low attack complexity, partial attack type, no privileges required, user interaction required, and high impact on confidentiality and integrity. A patch is available and should be applied to mitigate the issue.
Multiple security vulnerabilities have been identified in CUPS, the open source printing system used on UNIX-like operating systems. These include an arbitrary file write due to predictable temporary file handling, command injection via email notification recipient addresses, multiple denial-of-service conditions from null pointer dereferences and double-free errors, and a resource exhaustion vulnerability. These issues affect versions prior to 2.4.0-25.oe2203sp4. A security update addressing these vulnerabilities is available.
CVE-2026-9672 is a medium severity vulnerability in the gd library affecting specific SUSE package versions, including 2.3.3-160000.3.1.aarch64, 2.2.5-8.el8_10.i686, and versions prior to 2.3.3-5.oe2403sp3. The vulnerability has a CVSS score of 6.5 with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and availability. A security update has been issued to address the issue. No known exploits are reported in the wild.
A command injection vulnerability exists in rpm when processing tarball paths or filenames via the `rpmbuild -t*` command. An attacker who can control these inputs in automated build or CI workflows may execute arbitrary commands with the build user's privileges. This could lead to information disclosure or disruption of the build environment.
A vulnerability in libsolv, a dependency-resolution library used by RPM-based package managers like dnf and zypper, allows an out-of-bounds memory write when processing specially crafted or corrupted .solv cache files. This flaw can cause the affected package management tools to crash, resulting in a denial of service. The vulnerability does not enable arbitrary code execution because the out-of-bounds write stores a fixed, non-attacker-controlled value.