Spreadsheet::XLSX versions before 0.19 for Perl contain a vulnerability that allows arbitrary code execution. The flaw arises from the use of string eval on number format conditions in ExcelFmt during workbook parsing. An attacker can craft a malicious XLSX file with a specially formatted number condition to execute arbitrary Perl code when the file is processed.
Tornado's RedirectHandler in versions >=2.2.0 <2.2.2_7 allows open redirect vulnerabilities when URL templates include substitutions that can alter the scheme or host of the redirect target. This can enable attackers to craft URLs that redirect users to arbitrary external sites, facilitating phishing attacks. The issue is fixed in version 2.2.2_7 by rejecting substitutions that change the scheme or host.
Tornado HTTP servers have a vulnerability in their header parser that causes quadratic CPU usage when parsing HTTP headers with obsolete line folding (line continuation with leading whitespace). An unauthenticated attacker can exploit this by sending specially crafted requests with many folded header lines, causing the server's event loop to block and degrade availability. The issue affects all Tornado HTTP servers before version 6.6. The vulnerability is fixed in Tornado 6.6 by removing support for obsolete line folding and rejecting header lines starting with whitespace.
Tornado HTTP servers are vulnerable to event loop blocking and excessive memory use when processing HTTP/1.1 chunked transfer encoding bodies composed of many small chunks. An attacker can send a request body with millions of 1-byte chunks, causing the event loop to block for extended periods (up to a minute for ~100 MB bodies) and consuming significantly more memory than the actual body size. This affects all Tornado HTTP servers that read request bodies without early rejection and also affects the SimpleAsyncHTTPClient when reading responses. The issue is fixed in Tornado 6.6 with changes to yield to the event loop periodically and optimize chunk handling.
A vulnerability in Apple Xcode allows an app to read arbitrary files due to improper handling of symlinks. This issue is resolved in Xcode version 27.2 with improved symlink handling.
A vulnerability in Apple Xcode prior to version 27.2 could allow an app to access sensitive user data due to an authorization issue. This flaw was addressed by improved state management and fixed in Xcode 27.2.
GitPython's Submodule.move() API does not properly validate symbolic links in the destination path, allowing an attacker-controlled symlink to redirect submodule moves outside the parent repository worktree. This can cause the submodule checkout to be moved to an unintended external directory, corrupting the parent repository's index and configuration. The vulnerability requires an attacker to supply a malicious Git repository with a symlinked path and the application to call Submodule.move() on a path beneath that symlink. No code execution or confidentiality impact is demonstrated, but the integrity of the repository is compromised.
GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method that allows an attacker to read arbitrary files on the system by controlling the branch name. This occurs because the branch name, passed as a positional argument, is not properly sanitized and can inject unsafe git checkout options such as --pathspec-from-file, leading to disclosure of sensitive files like /etc/passwd. The vulnerability arises from an incomplete fix of prior advisories that only guarded keyword arguments but missed positional argument checks in Head.checkout().
GitPython's Remote.pull() method improperly handles the positional refspec argument, allowing an attacker to inject a malicious --upload-pack option that bypasses the unsafe-option guard. This leads to arbitrary command execution with the privileges of the calling process when using local-path or SSH transports. The vulnerability affects Snakemake versions from 7.20.0 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1.
CVE-2026-110857 is a vulnerability in Snakemake's use of GitPython where three Git command wrapper methods omit critical checks for unsafe protocols and options. This omission allows potential remote code execution (RCE) when using the ls_remote method with certain git transport protocols, specifically the 'ext' transport if permitted by the victim's git configuration. The merge_base and IndexFile.move methods also forward caller-controlled arguments without proper sanitization, creating latent injection surfaces. The vulnerability affects Snakemake versions from 5.5.3 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1.
Snakemake's use of GitPython contains a regex vulnerability in the parse_actor_and_date function that causes quadratic backtracking on malformed author/committer/tagger identity lines missing or having malformed trailing epoch or timezone data. This results in CPU exhaustion when processing crafted commit or tag objects with long malformed identity lines. The issue affects Snakemake versions from 5.5.3 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1 that modifies the regex to prevent backtracking.
GitPython's _clone() method improperly expands environment variables in the separate_git_dir parameter derived from attacker-controlled .gitmodules submodule names. This leads to leakage of environment variable values as directory names on disk and in debug logs when cloning and updating submodules from a malicious repository. The flaw affects GitPython versions from 5.5.3 up to but not including 9.27.0_1 and has been fixed in 9.27.0_1.
Two security vulnerabilities have been identified in the expat C library used for XML parsing. The first is a denial of service vulnerability caused by an integer overflow in the expat_realloc function (CVE-2026-102633). The second is an information disclosure vulnerability due to a heap buffer over-read in the XML_ParseBuffer function (CVE-2026-77214). Red Hat has issued an important security update for expat in Red Hat Enterprise Linux 8 to address these issues.
A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.
CVE-2026-118959 is a vulnerability in the Red Hat Build of Keycloak involving improper authentication. The flaw arises when the kc_action query parameter is set to a mandatory user action, such as profile verification or terms acceptance. Due to incorrect handling, Keycloak may skip these mandatory challenges and issue an authorization code, allowing users to bypass administrative requirements. Exploitation requires valid user credentials and affects only specific mandatory actions. No patch or mitigation meeting Red Hat's criteria is currently available.
CVE-2026-118947 is a vulnerability in the UMA resource registration endpoint of the keycloak-services component in Red Hat Build of Keycloak. When remote resource management is enabled, an authenticated user with the uma_protection role and knowledge of a target resource ID can update resources they do not own. This allows unauthorized modification of resource configurations such as names, URIs, and scopes. Exploitation requires valid credentials and specific permissions. The vulnerability is due to a missing ownership check in the resource registration code path.