Search: 22.9-18

A vulnerability in python-virtualenv versions from 21.14.9 up to but not including 21.14.13 allows an attacker to inject commands via the --prompt value in the bash bin/activate script. This occurs because the prompt value is copied into the PS1 environment variable without escaping dollar signs or backticks when promptvars and POSIX mode are disabled. Subsequent re-enabling of promptvars or POSIX mode can cause command substitution and execution under the activating user's privileges. The issue is fixed in version 21.14.13.

A buffer overflow vulnerability exists in the Bluetooth HCI USB transport class of the Zephyr OS USB device stack. The flaw occurs because controller-to-host HCI packets are copied into a fixed-size USB transfer buffer without proper length checks, allowing memory corruption. This can be triggered remotely by an unauthenticated attacker within Bluetooth range via oversized HCI packets. The vulnerability can lead to arbitrary code execution on devices without memory protection or cause a denial of service if assertions are enabled.

A vulnerability in the Zephyr DNS stub resolver causes it to use a fixed UDP source port per configured server for DNS queries, violating RFC 5452 requirements. This allows an off-path attacker with UDP reachability to the device to predict the source port and attempt to spoof DNS responses by guessing only the 16-bit transaction ID. Successful spoofing can cause the application to resolve attacker-chosen addresses, potentially poisoning the DNS cache if enabled. The vulnerability is mitigated by a fix that randomizes the source port per query, increasing the guessing space.

The DHCPv4 client in Zephyr's network subsystem used a predictable transaction identifier (xid) for DHCP transactions, violating RFC 2131 requirements. This predictable xid allows an attacker on the same network segment or with prior knowledge of the xid to forge DHCP replies that the client accepts without verifying the server source. Such forged replies can redirect the device's network traffic by changing its default gateway and DNS resolvers, or disrupt network configuration by sending forged DHCPACK or DHCPNAK messages. The issue affects specific Zephyr versions and has a medium severity rating with a CVSS score of 5.6.

A vulnerability in Zephyr's arm64 MMU backend causes improper TLB invalidation, allowing user threads to retain access to stale memory mappings after page eviction. This flaw breaks memory isolation enforced by CONFIG_USERSPACE, enabling information disclosure and memory corruption, potentially leading to full system compromise. The issue affects arm64 builds with CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled and demand-paged pages mapped into user memory domains. A fix changes the TLB invalidation to cover all ASIDs and both global and non-global entries, preventing stale translations from persisting.

A vulnerability in the Zephyr RTIO streaming completion callback adxl345_process_fifo_samples_cb() causes out-of-bounds writes when the allocated buffer is smaller than a full FIFO batch. This leads to silent corruption of other RTIO consumers' data or potential crashes. Exploitation requires specific hardware with an interrupt-wired ADXL345 sensor and certain buffer pool conditions, with no network or external input vector.

A vulnerability in the WireGuard VPN service implementation in Zephyr (subsys/net/lib/wireguard/wg.c) allows an attacker to spoof a UDP datagram to update a peer's endpoint address without authentication. This causes the peer to send handshake initiations and encrypted packets to an attacker-controlled address, resulting in persistent denial of service and potential traffic interception. The flaw occurs when the receiver index in a transport-data message does not match any session, leading to unauthenticated endpoint updates. The vulnerability affects Zephyr versions 3.1.2-1 and related builds. The issue is fixed by removing unauthenticated endpoint learning and requiring authenticated messages for endpoint updates.

Zephyr's OpenThread integration used a default joining credential (PSKd) "J01NME" that is publicly known and used in documentation and samples. If a firmware build enables joiner autostart without overriding this default PSKd, an unauthenticated attacker within radio range can impersonate a Thread commissioner, complete the authentication handshake, and provision the device with a malicious operational dataset. This allows the attacker to control the device's network traffic and isolate it from its intended network. The vulnerability affects specific Zephyr versions and is mitigated by removing the default PSKd and enforcing build-time checks requiring a unique PSKd when autostart is enabled.

Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP, a widely used scripting language for web servers and CMS systems. Both vulnerabilities involve improper handling of memory during fatal error processing with longjmp(), allowing attackers to execute arbitrary code remotely. CVE-2026-109618 arises from uninitialized request memory after out-of-memory errors, while CVE-2026-109619 involves global memory pointing to freed regions that can be exploited in subsequent requests. Over 22.6 million exposed instances potentially vulnerable have been identified. Palo Alto Networks provides protections through multiple security products and recommends immediate patching. At least one European government took precautionary measures by taking its website offline. Users should review the PHP Group’s security advisory for patching guidance.

CVE-2026-106071 is a low-severity vulnerability affecting specific Ubuntu-distributed versions of Node.js. The vulnerability has a CVSS 3.0 base score of 3.6, indicating limited impact primarily on confidentiality and integrity with no impact on availability. The exact nature of the vulnerability is unknown due to lack of descriptive details. No public exploits or known active exploitation have been reported. The affected versions are specific Ubuntu package builds of Node.js versions 18.13.0, 18.19.1, and 20.19.4.

CVE-2026-106069 is a high severity vulnerability affecting specific Ubuntu-packaged versions of Node.js. The vulnerability has a CVSS 3.0 score of 7.4, indicating a network attack vector with high impact on confidentiality and integrity but requiring high attack complexity and no privileges or user interaction. The exact nature of the vulnerability is not described in the available data.

CVE-2026-105482 is a high severity vulnerability affecting specific Ubuntu-distributed versions of Node.js. The vulnerability has a CVSS 3.0 score of 7.4, indicating a network attack vector with high impact on confidentiality and integrity but requiring high attack complexity and no privileges or user interaction. The exact nature of the vulnerability is unknown as no detailed description or technical details are provided. No known exploits in the wild have been reported. The affected versions are specific Ubuntu package builds of Node.js versions 18.13.0, 18.19.1, and 20.19.4. No patch or remediation information is available, and the patch status is not confirmed.

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is removed while the user space process that created the P2P device (e.g. wpa_supplicant) is still exiting, the P2P device interface is removed twice and the kernel crashes. The two paths are: - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P device. nl80211_del_interface() holds RTNL and the wiphy mutex and calls brcmf_p2p_del_vif(), which disables discovery and waits up to 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(), which unregisters the wdev and frees the vif and the ifp. - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives, and calls brcmf_remove_interface(ifp, false) for the same ifp. brcmf_p2p_ifp_removed() reads ifp->vif and then blocks on rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls cfg80211_unregister_wdev() on the wdev that was already unregistered and freed. The second list_del_rcu() of wdev->list faults on LIST_POISON2: brcmfmac: brcmf_p2p_del_vif delete P2P vif brcmfmac: brcmf_p2p_deinit_discovery enter brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared brcmfmac: brcmf_detach Enter brcmfmac: brcmf_bus_change_state 1 -> 0 brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed [1.5 s later, brcmf_p2p_del_vif() timed out] brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed Unable to handle kernel paging request at virtual address dead000000000122 Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211] Call trace: _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211] cfg80211_unregister_wdev+0x10/0x1c [cfg80211] brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac] brcmf_remove_interface+0x1f4/0x254 [brcmfmac] brcmf_detach+0x88/0x180 [brcmfmac] brcmf_sdio_remove+0x90/0x7b0 [brcmfmac] brcmf_sdiod_remove+0x20/0xa0 [brcmfmac] brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac] sdio_bus_remove+0x38/0x144 device_release_driver_internal+0x1e8/0x2c0 device_release_driver+0x14/0x20 brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac] brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac] __exit_compat+0x18/0x418 [brcmfmac_cyw] __arm64_sys_delete_module+0x1ac/0x244 The log was taken with debug=0x406 on an i.MX 8M Plus board with a CYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of brcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same in mainline. To reproduce: 1. Start wpa_supplicant on wlan0 and let it associate. It creates the P2P device (iw dev shows "type P2P-device"). 2. Stop wpa_supplicant and remove the driver without waiting for wpa_supplicant to exit: kill $(pidof wpa_supplicant) rmmod brcmfmac_cyw brcmfmac The crash is reproducible on that board. For the interface without a netdev (the P2P device), take RTNL and the wiphy mutex in brcmf_detach() before reading iflist, and remove it with locked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the slot empty. If brcmf_detach() runs first, nl80211 does not find the wdev any more. The interfaces with a netdev are removed as before, because brcmf_del_if() takes RTNL on its own for the primary interface.

Cacti versions prior to 1.2.31 contain a User Enumeration vulnerability that allows attackers to distinguish valid usernames based on subtle differences in login error messages. Specifically, the capitalization of the letter 'f' in the word 'failed' differs depending on whether the username exists. This vulnerability has been patched in version 1.2.31.

Cacti versions prior to 1.2.31 have a vulnerability in their input blocklist that fails to filter certain characters such as single-quote, double-quote, redirect operators, and subshell parentheses. This allows an authenticated admin to bypass input validation by saving crafted input strings containing these characters. The issue is fixed in version 1.2.31.

XDG Desktop Portal versions prior to 1.22.1 contain a vulnerability where malicious sandboxed applications can misuse the FileTransfer.RetrieveFiles method to intercept drag-and-drop and copy-paste data intended for other applications. The vulnerability arises from predictable token generation using GLib's GRand based on the Mersenne Twister PRNG, allowing attackers to predict future tokens and gain unauthorized access to resources. This issue has been fixed in version 1.22.1.

A vulnerability in the Linux kernel's dm-integrity subsystem causes a NULL pointer dereference leading to a crash when the device is activated with the 'R' flag and the SB_FLAG_DIRTY_BITMAP flag is set. The issue occurs during the dm_integrity_resume function's attempt to read the journal containing the bitmap. The patch modifies dm-integrity to skip writes during resume if the device is activated in 'R' mode.

A vulnerability in the Linux kernel's dm-integrity module allows an attacker to modify the superblock on the underlying device while the dm-integrity device is suspended. This causes a mismatch between the in-memory and on-disk superblock data upon resume, potentially leading to out-of-bounds memory writes.

CVE-2026-99085 is a Linux kernel vulnerability affecting the CPU hotplug process when tasks managed by the BPF scheduler remain on a CPU that is going offline. This can cause the CPU hotplug thread to hang, potentially stalling the CPU offline operation. The issue arises because tasks on the BPF scheduler are still counted on the CPU's runqueue, but the CPU no longer dispatches these tasks, leading to a deadlock scenario. The fix involves re-enqueuing tasks on the local dequeue and ensuring dispatch continues until the runqueue goes offline.

CVE-2026-99084 is a vulnerability in the Linux kernel's readdir implementation where an inode lock is not taken on an immutable directory. This can cause readers to hold a shared lock for extended periods, potentially stalling other operations such as mkdir or lookups in certain mount namespaces. The issue affects specific Linux kernel versions and has been resolved by adding an immutable flag to directories that never change, allowing iterate_dir() to skip the lock.