The systeminformation package version 5.33.15 on Windows is vulnerable to command injection via the services() function. The vulnerability arises because the sanitizer removes ASCII quotes but not Unicode curly quotes, allowing crafted input to break out of a PowerShell filter string and execute arbitrary commands with the Node.js process permissions. This can lead to unauthorized command execution if attacker-controlled input reaches services(). The issue is fixed in version 5.33.16.
vLLM versions from 0.16.0 up to but not including 0.32.0 have a vulnerability in the /v1/responses API endpoint where the request-level chat_template_kwargs parameter bypasses the trust_request_chat_template security gate. This allows an authenticated user to supply a malicious Jinja chat template despite the trust flag being disabled, potentially causing CPU and memory exhaustion. The issue was fixed in version 0.32.0.
Echo, a Go web framework, had a vulnerability in versions prior to 4.16.0 and 5.4.0 where it trusted forwarded scheme headers from any client. This allowed an attacker to bypass HTTPSRedirect by claiming an HTTPS scheme over plaintext HTTP, or suppress the Strict-Transport-Security header when behind a TLS-terminating proxy. The issue is fixed in versions 4.16.0 and 5.4.0.
CVE-2026-118656 is an open redirect vulnerability in the labstack echo Go web framework. Versions prior to 4.16.0 and 5.4.0 improperly validate redirect targets, allowing specially crafted paths containing a slash, TAB, and separator to bypass checks. This results in the Location header emitting a redirect that browsers normalize to an attacker-controlled host. The issue is fixed in versions 4.16.0 and 5.4.0.
CVE-2026-118654 is a path traversal vulnerability in the Echo Go web framework's static file handlers prior to versions 4.16.0 and 5.4.0. The flaw allows an unauthenticated attacker to bypass route-level middleware protections by exploiting how dot segments are normalized after route matching, enabling unauthorized reading of protected files accessible via static filesystem mounts. This issue is a regression from an incomplete fix of a previous vulnerability (CVE-2026-55677) and is resolved in Echo versions 4.16.0 and 5.4.0.
A reflected cross-site scripting (XSS) vulnerability exists in the labstack echo Go web framework prior to versions 4.16.0 and 5.4.0. The vulnerability occurs in the Context.JSONP and Context.JSONPBlob methods, which concatenate an unvalidated callback parameter into a JavaScript response. This allows an attacker to inject executable script code if they can control the callback argument in an application route. The issue is fixed in versions 4.16.0 and 5.4.0.
CVE-2026-118650 is a vulnerability in the labstack Echo Go web framework affecting versions prior to 4.16.0 and 5.4.0. It involves improper handling of URL encoding in the globally mounted middleware.Static instance, where the static handler decodes the URL path differently than the router, leading to inconsistent route protection. This discrepancy can allow an encoded slash to resolve to files under the static root unexpectedly. The issue is fixed in versions 4.16.0 and 5.4.0.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the labstack Echo Go web framework prior to versions 4.16.0 and 5.4.0. The issue arises when the MethodOverride middleware is registered before the CSRF middleware in the post-routing chain, allowing an attacker to bypass CSRF token validation and Sec-Fetch-Site checks by overriding the HTTP method of a POST request. This can lead to unauthorized state-changing actions if the victim is authenticated and the override value is controllable via a browser-submitted request. The vulnerability is fixed in versions 4.16.0 and 5.4.0.
A critical HTTP request/response smuggling vulnerability (CVE-2026-118264) affects the Echo Go web framework versions from 4.0.0 up to but not including 4.16.1 and from 5.0.0 up to but not including 5.4.1. The flaw arises in Echo's Proxy middleware, which improperly handles client WebSocket upgrade requests by selecting a raw tunnel before verifying upstream acceptance. If the upstream rejects the upgrade with a keep-alive response, subsequent HTTP requests bypass Echo's routing and middleware, potentially allowing attackers to circumvent authentication or authorization controls enforced by Echo routes. This vulnerability is fixed in versions 4.16.1 and 5.4.1.
CVE-2026-118262 is a resource management vulnerability in the labstack Echo Go web framework affecting versions 4.15.0 up to but not including 4.16.1, and 5.0.0 up to but not including 5.4.1. The issue occurs in Echo's Proxy middleware where resources such as handlers, goroutines, and network connections may be retained after a WebSocket client disconnects if the upstream connection remains open. This can lead to resource accumulation and potential denial of service. The vulnerability is fixed in versions 4.16.1 and 5.4.1.
A vulnerability in the labstack Echo Go web framework versions 4.0.0 through 4.16.0 allows denial of service via uncontrolled resource consumption. The opt-in Decompress middleware does not limit the size of gzip-decoded request bodies, enabling small compressed requests to expand into very large payloads that exhaust memory or CPU. This issue is fixed in version 4.16.1.
CVE-2026-118260 is a high-severity vulnerability in the Echo Go web framework versions 4.0.0 through 4.16.0. The opt-in BodyDump middleware reads entire request bodies into memory and retains full response bodies without limits, allowing unauthenticated clients to cause uncontrolled memory consumption. This can lead to exhaustion of process memory through large or repeated requests and responses. The issue is fixed in version 4.16.1.
Red Hat has released a security update for the kpatch live kernel patch module targeting kernel version 6.12.0-211.16.1.el10_2. This update addresses multiple vulnerabilities in the Linux kernel, including issues in netfilter ebtables, pppoe header handling, network bridge fast-leave behavior, packet hard header length consistency, and xfrm ah6 routing header validation. The update is rated as Important by Red Hat Product Security.
The npm package 'itsa-react-checkbox' version 16.0.5 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removal of the package alone may not eliminate all malicious software introduced by it.
The Drupal Commerce Shipping module has an access control vulnerability in the form to resend receipts. This flaw allows certain users, under specific configurations, to access receipts and customer information for orders they should not be authorized to view. The issue affects versions prior to 2.16.0 and versions from 3.0.0 up to but not including 3.0.6. Fixed versions are 2.16.0 and 3.0.6.
The Drupal Commerce Shipping module has an access bypass vulnerability that allows insufficient protection of shipment references and shipment entity fields. This flaw can lead to unauthorized modification of shipment states or deletion of shipments. Exploitation requires the attacker to have a cart with API-based access, which mitigates the risk to some extent. Fixed versions 2.16.0 and 3.0.6 address this issue.