The npm package 'itsa-react-checkbox' version 16.0.5 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removal of the package alone may not eliminate all malicious software introduced by it.
MIME::Parser versions before 5.521 for Perl have a vulnerability where no limit is set on the number of message parts by default, which can lead to memory exhaustion. The max_parts option defaulted to -1, disabling limits and allowing the parser to build an entity for every part in a message regardless of quantity. Version 5.521 introduces default limits of max_parts to 1000 and max_depth to 64 to mitigate this issue.
CVE-2026-116268 is a vulnerability in MIME::Field::ParamVal versions before 5.521 for Perl, where inefficient regular expression handling of unclosed comments in MIME header parameters can cause CPU exhaustion. Parsing a header with unclosed parentheses results in quadratic time complexity, significantly slowing processing. This issue is fixed in version 5.521.
MIME::Head versions from 5.518 up to but not including 5.521 for Perl improperly decode multipart boundaries containing partially encoded words without marking them as ambiguous. This allows a remote sender to craft a multipart boundary that is interpreted differently by MIME-tools and other mail readers, potentially hiding attachments from filters relying on ambiguous_content() checks while still displaying them in recipients' mail clients.
The AI module for Drupal includes a submodule called AI Automator that automatically fills out fields using AI based on other fields. A vulnerability exists because the module does not sufficiently check access permissions to text formats, allowing users to author field data in text formats they should not have access to. This could lead to unauthorized content creation or manipulation. Fixed versions 1.4.11 and 1.5.2 address this issue.
CVE-2026-118581 is a vulnerability in the BSON encoding component of the MongoDB Java Driver versions 5.8.0 up to but not including 5.14.0. It allows an attacker who can supply raw bytes to the application to craft a structurally inconsistent BSON document that causes the database to interpret extra attacker-controlled fields in a command. This can result in unintended modification of the executed database command, potentially altering data read or written under the application's credentials. No authentication or user interaction is required beyond influencing the raw bytes.
CVE-2026-118608 is an out-of-bounds read vulnerability in the Alpine iLX-F511 device's libanwbtstack.so component, specifically in the prh_rfcomm_cc_process_test function. This flaw allows a network-adjacent attacker who can pair a malicious Bluetooth device with the target to disclose sensitive information by reading beyond allocated buffer boundaries. The vulnerability has a low CVSS score of 3.5 and does not indicate direct code execution or denial of service by itself.
CVE-2026-106079 is an OS Command Injection vulnerability in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor. It allows an attacker with configuration write privileges to execute arbitrary commands as root via the YANG configuration interface. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS v3.1 score is 8.8, indicating high severity.
CVE-2026-103408 is a stack-based buffer overflow vulnerability in the DHCP client of Juniper Networks Session Smart Router. It allows an unauthenticated attacker on the local network to execute remote code by sending a malicious DHCP reply. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. It has a high severity with a CVSS score of 8.8.
CVE-2026-103407 is a path traversal vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's ConfigDirector component. It allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-103406 is a critical OS command injection vulnerability in the AutomatedProvisioner component of Juniper Networks Session Smart Conductor. It allows a remote attacker to execute arbitrary commands with root privileges by sending a specially crafted salt minion ID. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The flaw has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-103405 is an injection vulnerability in the web server component of Juniper Networks Session Smart Router and Session Smart Conductor. It allows an attacker to inject arbitrary HTTP headers through unsanitized request body parameters. The flaw is classified as CWE-74, indicating improper neutralization of special elements in output used by a downstream component. This vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS 3.1 base score is 5.8, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. No known exploits are reported in the wild.
CVE-2026-103404 is a vulnerability in Juniper Networks Session Smart Conductor's RoutingManager component where incorrect permission assignment allows a local user to access sensitive routing credentials. This occurs through triggering processes that write to the /tmp directory. The issue affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The vulnerability has a CVSS score of 6.8, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.
CVE-2026-103403 is an OS Command Injection vulnerability in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor. It allows an attacker with limited privileges to execute arbitrary commands and delete files by exploiting improper neutralization of special elements during audit rule deletion. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. It has a high severity with a CVSS score of 8.8.
CVE-2026-103391 is an out-of-bounds write vulnerability in the TCP proxy/optimization path of Juniper Networks Session Smart Router. It allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash by sending a transit TCP packet with a specially crafted TCP option length. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS score is 5.3, indicating a medium severity level.
CVE-2026-118510 is a high-severity type confusion vulnerability in the Laravel MongoDB integration library. It arises from a flaw in how relationship query building handles data types, causing checks for the absence of related records to use identifiers of incorrect types. This silent failure can allow users with limited privileges to access, modify, or delete documents that should be restricted. The issue affects versions from 3.2.3 up to but not including 5.12.0 and is fixed in version 5.12.0.
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.
OpenVPN ovpn-dco-win versions 0.6.5 through 2.8.13 contain a race condition vulnerability in the TCP connect path that allows unprivileged local users to cause a denial of service resulting in a system crash.
A deserialization of untrusted data vulnerability exists in Phoenix Media Rename (phoenix-media-rename) up to version 3.13.5. This flaw allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability is identified as CVE-2026-116389 with a CVSS score of 8.8, indicating a high severity risk.