CVE-2026-112326 is a vulnerability in GitLab EE versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. It involves improper cleanup on thrown exceptions that could allow an authenticated user with read-only permissions to permanently delete existing vulnerability records. This occurs due to flawed error handling logic that fails to differentiate between pre-existing and newly created records. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
A use-after-free (UAF) vulnerability exists in PHP's session.upload_progress handler related to serialize-state cross-request handling. This vulnerability does not lead to remote code execution but can cause memory safety issues and arbitrary memory reads/writes. The vulnerability affects prefork-based PHP setups and is confirmed with a medium severity impact. A pre-patch mitigation is available by disabling session.upload_progress in PHP configuration. Official patches are expected in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.11.
CVE-2026-114383 is a critical stack-based buffer overflow vulnerability in TOTOLINK EX200 firmware version 5.2.3c.7200. It exists in the setWiFiAclAddConfig function within the wireless.so component, accessible via the /cgi-bin/cstecgi.cgi endpoint. The flaw can be exploited remotely without authentication by manipulating the macAddress parameter. Public exploit code is available, increasing the risk of exploitation.
CVE-2026-114382 is a critical stack-based buffer overflow vulnerability in TOTOLINK EX200 version 5.2.3c.7200. It occurs in the setStaticDhcpConfig function within /cgi-bin/cstecgi.cgi of the lan.so component. The flaw is triggered by manipulating the Comment argument, allowing remote attackers to execute code. Public exploit code has been released, increasing the risk of attacks.
A high-severity vulnerability (CVE-2026-114145) in python-git (GitPython) allows remote code execution due to validation of a submodule's .git path only occurring after cloning into it. This flaw affects multiple specific versions of the python-git package. The vulnerability has a CVSS score of 7.5, indicating a high impact on confidentiality, integrity, and availability. No public exploits or known in-the-wild exploitation have been reported. The vulnerability is not related to a cloud service and no patch information is provided in the data.
CVE-2026-114138 is a high severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework prior to 3.1. It has a CVSS 3.1 score of 7.5, indicating a network exploitable issue with no privileges or user interaction required, causing a high impact on availability but no confidentiality or integrity impact.
Algorithm::UrataniTakeda versions 0.1.5 through 0.1.6 for Perl contain a memory exhaustion vulnerability due to a failure shift cache that is never cleared during search operations. This cache grows with each new distinct character processed by a long-lived matcher object, potentially leading to unbounded memory consumption.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
* kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
* kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
* kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
* kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
* kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)
* kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-114136 is a high-severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework. It has a CVSS 3.1 score of 7.5, indicating high impact primarily due to availability disruption. No public exploit or known active exploitation is reported. The vulnerability does not impact confidentiality or integrity but can cause denial of service.
Apache Traffic Server contains a vulnerability that can cause it to stall a chunked transfer it processes. This issue affects multiple specific versions of the Traffic Server package. The vulnerability has a medium severity rating with a CVSS score of 5.3, indicating it can impact availability but does not affect confidentiality or integrity.
Apache Traffic Server versions including 9.2.15, 10.1.4, and 10.2.0 have a vulnerability identified as CVE-2026-111810. The issue involves an unthrottled write operation, which can lead to a high severity impact on availability. The CVSS score is 7.5, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.
Two critical remote code execution vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed on October 21, 2026. CVE-2026-109618 involves corruption during out-of-memory handling that disrupts PHP while internal request data is partially initialized, causing invalid data processing. CVE-2026-109619 exploits a stale global state where request-owned internal state persists after memory is freed. Both vulnerabilities affect ARM64 systems and x86 systems without ASLR. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Over 2.6 million internet-facing PHP hosts were identified as vulnerable, with 42% running end-of-life branches lacking official patches. Early exploitation attempts have been observed, including scanning and webshell deployment targeting the upload-progress vulnerability path.
CVE-2026-112381 is a vulnerability in Apache Traffic Server that causes a crash due to a null pointer dereference. This occurs when a client POST request is half-closed while a chunked origin response is being reparsed in a reentrant write-ready callback. The issue is timing-dependent and was introduced by backports related to CVE-2021-32564. Affected versions include 9.2.15, 10.1.4, and 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
CVE-2025-55702 is a high-severity HTTP request/response smuggling vulnerability in Apache Traffic Server. It occurs when a client sends a POST request with the Expect: 100-continue header and the origin server responds before reading the request body. This causes Apache Traffic Server to misinterpret the unread body as a new request, enabling an attacker behind a shared front-end proxy to smuggle requests past the front end and desynchronize responses for other users. The vulnerability affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-78119 is a vulnerability in the Zephyr project's Nuvoton NPCX eSPI driver affecting versions 3.6.0 up to but not including 4.5.0. The flaw involves improper bounds checking when parsing Target-Attached-Flash (TAF) requests, allowing out-of-bounds writes and reads in the eSPI controller memory. This can lead to controller crashes, hangs, or corruption of driver state that controls flash protection. The vulnerability requires host firmware or bus-level control to exploit and is not reachable by ordinary host software. A fix is available in Zephyr version 4.5.0 that adds proper bounds checking and rejects invalid requests. No in-tree board enables the vulnerable feature by default.
CVE-2026-78118 is a race condition vulnerability in the Zephyr kernel's wait queue handling on SMP (multi-CPU) systems. The kernel helper z_waitq_head() reads the head of a thread wait queue without holding the necessary scheduler spinlock, leading to potential use-after-free and out-of-bounds writes. This can cause scheduler state corruption or kernel crashes. Exploitation requires local code execution, multiple CPUs, and precise timing, making crashes more common than controlled corruption. The issue is fixed in Zephyr version 4.5.0.
CVE-2026-78116 is a use-after-free vulnerability in the Broadcom AFBR-S50 time-of-flight sensor driver within Zephyr OS versions 4.3.0 up to but not including 4.5.0. The flaw occurs when sensor data evaluation fails, causing the same RTIO submission to be completed twice, leading to memory corruption and potential loss of availability. The issue can be triggered by environmental sensor conditions without requiring software or physical access. A fix is available in Zephyr version 4.5.0.
CVE-2026-105937 is a missing authorization vulnerability in Apache Pulsar's shadow topic feature. It allows an authenticated user with tenant admin role in their own tenant to create or update shadow topics bound to source topics in other tenants without authorization on those source topics. This can lead to unauthorized reading of retained messages and unintended deletion of source topic ledger data. The issue affects Apache Pulsar versions from 3.0.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions disable shadow topics by default and require superuser role for cross-tenant shadow topic binding.