vLLM versions from 0.11.1 up to but not including 0.32.0 contain a reachable assertion vulnerability (CWE-617) in the image processing path for certain OCR models. A remote client with access to the OpenAI-compatible API can submit a specific image that causes a fatal assertion failure, resulting in a shutdown of the inference engine for all users. This denial-of-service condition is fixed in version 0.32.0.
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames.
Bandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout.
This issue affects bandit: from 1.11.0 before 1.14.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Weber Lazy Load for Videos lazy-load-for-videos allows Stored XSS.This issue affects Lazy Load for Videos: from n/a through 2.18.11.
Libreswan, an IPsec and IKE implementation for Linux, has multiple security vulnerabilities including a Use-After-Free bug in IKEv2 when using IKE-over-TCP (CVE-2026-94453). These issues affect versions prior to 4.15-11.el9_8. The vulnerabilities could impact the secure tunneling capabilities of VPNs relying on Libreswan. A security update fixing these issues is available from Red Hat.
The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
Electron versions prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6 do not properly block compromised eMudhra intermediate certificates. This improper certificate revocation check allows an attacker with a certificate from these intermediates to impersonate a TLS server by intercepting network traffic. The vulnerability is fixed in the specified versions.
CVE-2026-89317 is a medium severity vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE component. The vulnerability arises because the library parses the JWS 'crit' header but does not enforce the requirement to reject tokens with unrecognized critical extensions, as mandated by RFC 7515 §4.1.11. Since GOSE implements no header extensions, any token with a non-empty 'crit' header should have been rejected but was not.
CVE-2025-55702 is a high-severity HTTP request/response smuggling vulnerability in Apache Traffic Server. It occurs when a client sends a POST request with the Expect: 100-continue header and the origin server responds before reading the request body. This causes Apache Traffic Server to misinterpret the unread body as a new request, enabling an attacker behind a shared front-end proxy to smuggle requests past the front end and desynchronize responses for other users. The vulnerability affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
The uv software versions before 0.11.15 contain a path traversal vulnerability that can be exploited to compromise system confidentiality, integrity, and availability. This vulnerability is rated high severity with a CVSS score of 8.8. The affected versions include specific builds of 0.9.17+ds1-3 through 0.9.17+ds1-6. No public exploits or vendor patch information is provided in the data.
CVE-2026-91537 is a vulnerability in Oracle Solaris 11.4 that allows a low privileged attacker with logon access to the infrastructure to compromise the system. The vulnerability affects confidentiality, integrity, and availability, with a CVSS 3.1 base score of 7.8. Successful exploitation can lead to a full takeover of Oracle Solaris. Oracle has published a Critical Patch Update advisory addressing this and other vulnerabilities, recommending prompt application of patches.
CVE-2026-101560 is a vulnerability in Oracle Commerce Platform version 11.4.0 that allows a low privileged attacker with network access via HTTP to compromise the platform. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data, as well as unauthorized read access to some data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity.
CVE-2026-101537 is a critical vulnerability in Oracle Solaris 11.4 affecting the Utility component. It allows an unauthenticated attacker with network access via TCP to fully compromise the system, resulting in complete takeover. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches addressing this and many other vulnerabilities in its October 2026 Critical Patch Update. Users are strongly advised to apply the available security patches promptly to mitigate this risk.
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."
```
============================================================================
ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile._open()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```
A crafted 512-byte file makes Pillow's `Image.open()` spend about six minutes of processor time on one core before it gives up with `UnidentifiedImageError`. Anyone who can hand bytes to an application that opens images with Pillow's default settings can trigger this, for example through an upload form, a thumbnailer, or a service that checks whether a blob is an image. A few such files sent at once can tie up a typical pool of worker processes.
The cause is the `xbm_head` regular expression in `src/PIL/XbmImagePlugin.py:32-40`, which `XbmImageFile._open()` (line 58) runs over the first 512 bytes of any stream whose prefix starts with `#define`. Several adjacent parts of the pattern can match the same characters. `[ \t]+` overlaps with `.*` in the width and height lines and with `[^_]*` in the optional hotspot lines, and `[\r\n]+` closing the hotspot group overlaps with the following `[\000-\377]*`. The header sets a run of k spaces after each `#define` and a run of k line terminators after `_y_hot`, then omits the `[]` after `_bits`. That forces Python's backtracking matcher to try every way of splitting those runs and rescan the remaining bytes each time. The cost grows roughly as k to the fifth power: k = 60 measured 375 s, while a well-formed XBM of the same size opens in about 40 ms. Because this happens before any format is identified, none of Pillow's size, pixel-count or decompression-bomb limits apply, and upload size limits do not help because the file is tiny. `ImageFile.Parser.feed()` repeats the cost on every chunk until the stream is identified. The only existing mitigation is passing a `formats=` allowlist that excludes `"XBM"`.
The attached reproducer opens the same header with and without the trailing `[]`. The valid version opens as XBM in 52 ms. The broken version takes 0.1 s, 0.75 s, 3.0 s and 8.6 s at k = 10, 15, 20 and 25, and the slow k = 60 case is not run. This is the same class of bug as CVE-2021-25292 in `PdfParser`, but in a different plugin and reachable from plain `Image.open()`.
## Details
`XbmImageFile._open()` identifies an XBM file by running the module-level regex `xbm_head` over the first 512 bytes of the stream. The pattern has several adjacent quantifier pairs that can consume the same characters, followed by a `[\000-\377]*_bits\[]` tail that rescans the rest of the buffer for every way of splitting them. A 512-byte input built to exercise all of them and then fail the final literal keeps `Image.open()` in `xbm_head.match()` for minutes before it raises `UnidentifiedImageError`.
This 512-byte input (k = 60) takes 375 s of CPU in `Image.open(io.BytesIO(data))` with default settings, measured on the stock build at this commit:
```python
k = 60
data = b"#define" + b" "*k + b"_width 1\r"
data += b"#define" + b" "*k + b"_height 1\r"
data += b"#define" + b" "*k + b"_x_hot 1\r"
data += b"#define" + b" "*k + b"_y_hot 1" + b"\r"*k
data += b"_bits" # no "[]": the final literal never matches
data += b"A" * (512 - len(data)) # pad to the 512 bytes _open() reads
```
Calling `XbmImagePlugin.xbm_head.match(data)` directly gives the same picture: k = 10 → 0.11 s, k = 15 → 0.76 s, k = 20 → 3.0 s, k = 25 → 8.5 s, k = 30 → 19.9 s (roughly ×27 per doubling of k, i.e. about k^4.7). A well-formed 512-byte XBM matches in 10 µs and opens and loads through `Image.open()` in ~40 ms including plugin import; the same k = 60 header with `_bits[]` present matches in 5 µs.
The regex, `src/PIL/XbmImagePlugin.py:32`:
```python
xbm_head = re.compile(
rb"\s*#define[ \t]+.*_width[ \t]+(?P<width>[0-9]+)[\r\n]+"
b"#define[ \t]+.*_height[ \t]+(?P<height>[0-9]+)[\r\n]+"
b"(?P<hotspot>"
b"#define[ \t]+[^_]*_x_hot[ \t]+(?P<xhot>[0-9]+)[\r\n]+"
b"#define[ \t]+[^_]*_y_hot[ \t]+(?P<yhot>[0-9]+)[\r\n]+"
b")?"
rb"[\000-\377]*_bits\[]"
)
```
and the only call site, `src/PIL/XbmImagePlugin.py:58`:
```python
def _open(self) -> None:
…
m = xbm_head.match(self.fp.read(512))
if not m:
msg = "not a XBM file"
raise SyntaxError(msg)
```
For a well-formed header (`#define im_width 8\n…static char im_bits[] = {`) each `[ \t]+` eats the single space, `.*`/`[^_]*` eat the identifier prefix, and `[\000-\377]*_bits\[]` finds the literal on its first backward scan, so the match is linear. The crafted header diverges at every one of those points:
- `[ \t]+.*_width` and `[ \t]+.*_height`: the run of k spaces after `#define` can be split between `[ \t]+` and `.*` in k ways, all leading to the same continuation. Factor k each. (The choice of `\r` terminators is incidental: t