Search: 5.1.8.3

CVE-2026-114384 is a SQL injection vulnerability in itsourcecode Online Cake Ordering System version 1.0. The flaw exists in an unspecified function within the /transactionsave.php file, where manipulation of the 'del' argument can lead to SQL injection. This vulnerability can be exploited remotely and public exploit code has been disclosed. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

A use-after-free (UAF) vulnerability exists in PHP's session.upload_progress handler related to serialize-state cross-request handling. This vulnerability does not lead to remote code execution but can cause memory safety issues and arbitrary memory reads/writes. The vulnerability affects prefork-based PHP setups and is confirmed with a medium severity impact. A pre-patch mitigation is available by disabling session.upload_progress in PHP configuration. Official patches are expected in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.11.

CVE-2026-114383 is a critical stack-based buffer overflow vulnerability in TOTOLINK EX200 firmware version 5.2.3c.7200. It exists in the setWiFiAclAddConfig function within the wireless.so component, accessible via the /cgi-bin/cstecgi.cgi endpoint. The flaw can be exploited remotely without authentication by manipulating the macAddress parameter. Public exploit code is available, increasing the risk of exploitation.

CVE-2026-114382 is a critical stack-based buffer overflow vulnerability in TOTOLINK EX200 version 5.2.3c.7200. It occurs in the setStaticDhcpConfig function within /cgi-bin/cstecgi.cgi of the lan.so component. The flaw is triggered by manipulating the Comment argument, allowing remote attackers to execute code. Public exploit code has been released, increasing the risk of attacks.

This update includes the following RPMs: php: * php-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-bcmath-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-cli-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-common-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-dba-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-dbg-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-devel-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-embedded-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-enchant-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-ffi-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-fpm-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-gd-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-gmp-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-intl-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-ldap-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-mbstring-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-mysqlnd-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-odbc-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-pdo-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-pdo-dblib-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-pdo-firebird-8.5.12-1.hum1 (aarch64, x86_64) * php-pgsql-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-process-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-snmp-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-soap-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-sodium-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-tidy-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-xml-8.5.12-1.hum1 (aarch64, s390x, x86_64) * php-8.5.12-1.hum1.src (src)

A vulnerability exists in the Pillow Python imaging library prior to version 13.0.0 affecting the PILfont text-width functionality. The flaw has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily causing availability disruption. No known exploits are reported in the wild. Multiple Ubuntu package versions of Pillow are affected.

A high-severity vulnerability (CVE-2026-96640) affects the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The issue involves the PdfParser component, though specific technical details are not provided. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a network-exploitable flaw with high impact. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patch information are available in the provided data.

A vulnerability exists in the Pillow Python imaging library affecting versions from 9.1.0 up to but not including 13.0.0. The issue relates to the BmpRleDec component. The CVSS 3.1 base score is 6.5, indicating a medium severity impact primarily affecting availability. No public exploits or known active exploitation have been reported. The affected versions include specific Ubuntu package builds of Pillow. No patch or remediation details are provided in the available data.

A vulnerability exists in the Pillow Python imaging library prior to version 13.0.0 involving the MpoImageFile.seek function. The flaw can cause a denial of service condition. The issue affects multiple Ubuntu package versions of Pillow. The CVSS score is 6.5, indicating a medium severity impact primarily due to availability disruption.

A high-severity vulnerability (CVE-2026-114145) in python-git (GitPython) allows remote code execution due to validation of a submodule's .git path only occurring after cloning into it. This flaw affects multiple specific versions of the python-git package. The vulnerability has a CVSS score of 7.5, indicating a high impact on confidentiality, integrity, and availability. No public exploits or known in-the-wild exploitation have been reported. The vulnerability is not related to a cloud service and no patch information is provided in the data.

CVE-2026-114138 is a high severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework prior to 3.1. It has a CVSS 3.1 score of 7.5, indicating a network exploitable issue with no privileges or user interaction required, causing a high impact on availability but no confidentiality or integrity impact.

CVE-2026-114381 is a SQL injection vulnerability in itsourcecode Online Cake Ordering System version 1.0. The flaw exists in an unknown function within the /orderdetail.php file, where manipulation of the ID argument allows remote attackers to perform SQL injection. The vulnerability has a medium severity score of 5.3 and has been publicly disclosed with exploit code available.

Algorithm::UrataniTakeda versions 0.1.5 through 0.1.6 for Perl contain a memory exhaustion vulnerability due to a failure shift cache that is never cleared during search operations. This cache grows with each new distinct character processed by a long-lived matcher object, potentially leading to unbounded memory consumption.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) * kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590) * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-114136 is a high-severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework. It has a CVSS 3.1 score of 7.5, indicating high impact primarily due to availability disruption. No public exploit or known active exploitation is reported. The vulnerability does not impact confidentiality or integrity but can cause denial of service.

Apache Traffic Server contains a vulnerability that can cause it to stall a chunked transfer it processes. This issue affects multiple specific versions of the Traffic Server package. The vulnerability has a medium severity rating with a CVSS score of 5.3, indicating it can impact availability but does not affect confidentiality or integrity.

CVE-2026-112381 is a vulnerability in Apache Traffic Server that causes a crash due to a null pointer dereference. This occurs when a client POST request is half-closed while a chunked origin response is being reparsed in a reentrant write-ready callback. The issue is timing-dependent and was introduced by backports related to CVE-2021-32564. Affected versions include 9.2.15, 10.1.4, and 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.