ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msre_fn_removeComments_execute in apache2/re_tfns.c and inplace() in src/actions/transformations/remove_comments.cc implement t:removeComments by copying the character immediately after a comment terminator without re-evaluating it. Adjacent comments can therefore leave a later comment in the transformed value, allowing inline-comment obfuscation to bypass rules that depend on comment stripping. When a comment terminator is the final content, the same copy reads one byte beyond the input buffer. This issue is fixed in versions 2.9.15 and 3.0.17.
AsyncHttpClient versions prior to 3.0.12 and 2.16.1 contain a vulnerability where the WebSocketHandler.upgrade method improperly processes WebSocket handshakes with missing or invalid Sec-WebSocket-Accept values. Although the handshake is aborted, the pipeline installation and onOpen event still proceed, allowing frames from an unverified peer to be decoded and delivered. This issue is resolved in versions 3.0.12 and 2.16.1.
CVE-2026-106586 is a low-severity vulnerability in OpenSSH versions before 10.6 where the 'restrict' keyword in authorized_keys was intended to restrict tunnel forwarding but did not function as expected. This flaw represents an incorrect control flow implementation distinct from CVE-2026-73283.
CVE-2026-102110 is a medium severity vulnerability in Kiteworks Core where an endpoint used during initial appliance setup lacks authentication and does not enforce its intended state precondition. This allows an unauthenticated network attacker to repeatedly trigger the privileged activation process during the initial activation window, potentially disrupting setup and leaving the appliance incompletely configured. The vulnerability is only exploitable during the first-time activation of the appliance and is not accessible afterward.
CVE-2026-102124 is a vulnerability in the Kiteworks Core appliance setup interface where authentication is not enforced after initial configuration. This allows an unauthenticated attacker with network access to read and modify certain setup records such as contact name and email address. The vulnerability affects versions prior to 9.5.0. The CVSS score is 6.5, indicating a medium severity impact with limited confidentiality and integrity impact but no availability impact.
Authlib version 1.8.0 and earlier contains a critical vulnerability in its JsonWebSignature.deserialize_json() method, which bypasses signature verification. This flaw allows the method to return the payload as successfully verified without actually checking the signature or requiring a cryptographic key.
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).
A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.
CVE-2026-55624 is a medium severity vulnerability in the MintyItanium Lost-Auction Minecraft plugin. Before a specific commit (88c920b05042929db334ba06d57f052b42d6b3f8), players could exploit the plugin's GUI to take items such as barrier blocks or duplicate items. This issue was fixed in the referenced commit. No affected versions are explicitly stated, and no known exploits are reported in the wild.
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.
The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.
Example:
"ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE
"ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed
An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.
A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.
The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that combined the RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence: the form was ((length/hop/source/target checks) && (icmp_hdr->code != 0)). Because every legitimate ND message carries ICMPv6 code 0, an attacker setting code == 0 (the normal value) caused the entire predicate to evaluate false, so the packet was never dropped and all of the other checks were silently skipped. The bypassed checks include the mandatory Hop Limit == 255 verification (which proves an ND packet originated on-link and was not forwarded) and, for Router Advertisements, the requirement that the source be a link-local address, as well as multicast-target sanity checks. As a result, an adjacent on-link attacker — and, because the Hop-Limit-255 guard is bypassed, potentially a remote/off-link attacker whose packets would otherwise be rejected — can have forged Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages accepted. A forged RA lets the attacker reconfigure the victim's default router, on-link prefixes (SLAAC), MTU, reachable/retransmit timers, and (with CONFIG_NET_IPV6_RA_RDNSS) DNS servers, while forged NS/NA enable neighbor-cache poisoning, enabling man-in-the-middle, traffic redirection, and denial of service. The flaw is an input-validation/authentication weakness rather than a memory-safety issue: the underlying packet-parsing primitives (net_pkt_get_data, net_pkt_read, net_pkt_skip) are independently bounds-safe and the validated length is the true buffer length, so skipping the length check causes no out-of-bounds access. The defect has existed since the logic was introduced in 2018 and shipped in all releases through v4.4.0; it is fixed by splitting the condition so any failing check drops the packet.
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
CVE-2026-48844 is a high-severity vulnerability in Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. It involves insecure code evaluation logic in the LDAP autovalues option, which could lead to code injection.
CVE-2026-44928 is a vulnerability in uriparser versions before 1.0.2 where the EqualsUri function family can incorrectly determine that two different URIs are equal. This flaw affects control flow logic but does not impact confidentiality or availability.
The uuidjs library versions before 14.0.0 contain a vulnerability (CVE-2026-41988) where unexpected writes can occur when using external output buffers with UUID versions 3, 5, or 6. This issue does not affect the commonly used UUID version 4. The vulnerability is classified under CWE-670, indicating always-incorrect control flow implementation. The CVSS score is low (3.2), reflecting limited impact and complexity in exploitation. No known exploits are reported in the wild, and no official patch or remediation guidance is currently available from the vendor.
A vulnerability in the cut utility of uutils coreutils causes incorrect handling of the -s (only-delimited) option when a newline character is used as the delimiter. This flaw results in non-delimited lines being printed when they should be suppressed, potentially passing unexpected data to downstream scripts relying on strict output filtering. The issue is identified as CWE-670 (Always-Incorrect Control Flow Implementation). The vulnerability has a low severity score and no known exploits or patches are currently available.