A vulnerability in libphp's FastCGI IPv6 client access check causes an ACL bypass due to partial address comparison. The check compares only the first 12 bytes of a 16-byte IPv6 address, effectively matching on a /96 prefix rather than the full address. This allows an attacker with an IPv6 address sharing the first 96 bits of an allowed client to bypass access controls and reach the FastCGI endpoint.
A heap-buffer-overflow vulnerability exists in the php_openssl_matches_wildcard_name() function of libphp when processing TLS server certificates with wildcard names longer than the hostname being verified. This flaw can cause the PHP client to read memory beyond the allocated heap buffer. The vulnerability is reachable from any default client stream with verify_peer_name enabled, which is the default setting. Fixed versions are available.
Libphp versions prior to 8.2.34, 8.3.35, 8.4.26, and 8.5.11 contain a vulnerability where the HTTP stream wrapper forwards user-supplied Authorization, Cookie, and Proxy-Authorization headers unchanged when following redirects. This occurs even if the redirect target is a different host, port, or a downgrade from HTTPS to HTTP, potentially leaking credentials to unintended servers.
CVE-2026-91765 is a high-severity vulnerability in the libphp SOAP XML parser where the cleanup_xml_node() function performs unbounded recursion per XML nesting level. An unauthenticated attacker can exploit this by sending a SOAP request with deeply nested elements to exhaust the stack and crash the SoapServer process. This unbounded recursion also affects the SOAP value decoder and WSDL node search helper. Fixed versions are available.
CVE-2026-6103 is an integer overflow vulnerability in libphp's phar_tar_number() function, which parses the octal size field of a TAR header without proper overflow checks. This allows crafted archives to inject malicious entries that PharData treats as genuine during extraction. The issue affects multiple libphp versions prior to fixed releases in 8.2.34, 8.3.35, 8.4.26, and 8.5.11.
PHP on Windows does not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$, and CONOUT$ when used in file or stream paths. This allows an attacker to cause denial of service by opening a device instead of a regular file, potentially blocking or hanging requests and exhausting worker processes. The issue affects multiple PHP versions prior to fixed releases. Official patches are available.
A vulnerability in libphp's SOAP HTTP client allows a heap buffer overflow due to improper handling of signed integer overflow in response buffer size checks. This flaw can be triggered by a malicious SOAP server causing the client to allocate a smaller buffer than needed and then write excessive data into it. The issue affects multiple libphp versions prior to fixed releases. A patch is available to address this vulnerability.
A vulnerability in libphp's mysqlnd wire protocol parser allows reading beyond the end of server packets due to insufficient length checks. A malicious or compromised MySQL server can send truncated packets causing the client to read past buffer boundaries, leading to undefined behavior and potential process crashes. This issue affects multiple versions of libphp prior to fixed releases. A patch is available to address this problem.
Apache Airflow versions 3.0.0 through 3.3.1 have an insufficient session expiration vulnerability in the Core API logout endpoint. When API clients authenticate using a bearer token in the Authorization header, logging out does not revoke the token, allowing it to remain valid until its configured expiration (default 24 hours). An attacker with a copy of a valid token can maintain access after the victim logs out. This issue is fixed in Apache Airflow 3.3.2.
Apache Airflow versions prior to 3.3.2 have an information exposure vulnerability in the /assets/events API. Authenticated users with asset-read access can enumerate asset events for all DAGs, including those they are not authorized to view, due to missing access control filters. This exposure includes sensitive metadata such as source DAG ID, task ID, run ID, and event timestamps. Pagination and total entry counts also reveal the existence of hidden DAGs. This affects deployments using per-DAG access control without requiring special configuration. The issue is fixed in Apache Airflow 3.3.2 and later.
A vulnerability in Python's tarfile module causes the extraction filter to be bypassed when handling hardlink fallback on systems that do not support links. The filter function is called twice during extraction, but one call's return value is ignored, allowing potentially unsafe members to be extracted. This issue affects multiple Python versions prior to their respective fixed releases.
A medium severity vulnerability identified as CVE-2026-90439 affects Red Hat Hardened Images RPMs, specifically various nginx packages. Red Hat has released a security advisory with a patch update to address this issue. The update includes multiple nginx-related RPMs version 1.30.5-4.hum1 for different architectures. The vulnerability is related to a software defect categorized under CWE-787. A fix is available and users are advised to apply the update as per Red Hat's guidance.
A vulnerability in the MongoDB extension for Visual Studio Code allows an unauthenticated remote attacker to execute arbitrary commands via a specially crafted connection string. The extension fails to neutralize special characters in the connection string before embedding it into a shell command line for the integrated terminal. Exploitation requires user interaction, including accepting a user-supplied connection target and opening the shell feature. The confirmation prompt does not reveal the malicious input. This issue affects versions from 1.13.0 up to but not including 1.17.1. A patch is available to address this vulnerability.
Apache NiFi 1.10.0 through 1.27.0 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.28.0 or higher is the recommended mitigation.
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.
CVE-2026-78607 is a high-severity vulnerability in Elasticsearch's custom inference service where missing authorization allows users with inference execution privileges to redirect outbound inference traffic and potentially expose administrator credentials. This flaw involves privilege abuse due to lack of proper authorization checks.
A vulnerability in Elasticsearch involving inconsistent interpretation of HTTP requests, known as HTTP Request Smuggling (CWE-444), can lead to information disclosure. Under certain proxy deployment configurations, an attacker on the network could exploit this flaw to access confidential responses intended for other authenticated users. This issue affects specific Elasticsearch versions and has a medium severity rating. A patch is available to address this vulnerability.
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).