python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability

A flaw was found in the Python 'stringprep' module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 standard specified in RFC 3454. This deviation can lead to mismatches when processing internationalized domain names IDNA...

python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability

A flaw was found in the Python 'stringprep' module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 standard specified in RFC 3454. This deviation can lead to mismatches when processing internationalized domain names IDNA...

CVE-2026-17084

A flaw was found in the Python 'stringprep' module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 standard specified in RFC 3454. This deviation can lead to mismatches when processing internationalized domain names IDNA...

SUSE-SU-2026:4046-1 Security update for perl-URI

This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in nameprep bsc1277886...

OESA-2026-3591 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...

OESA-2026-3590 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...

OESA-2026-3588 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...

SUSE CVE-2026-71312

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

ASCII smuggling crosses over from AI prompt injection to phishing evasion

In this article 1. What is ASCII smuggling? 2. Writing a practical ASCII-smuggling signature 3. What we observed: ASCII smuggling repurposed for phishing 4. What is known and what is new 5. Is there a detection gap? 6. Mitigation and protection guidance 7. References 8. Learn More Microsoft...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary BM Maximo Application Suite - Predict Component uses setuptools-80.10.2-py3-none-any.whl Publicly disclosed vulnerability found by Scanner which are vulnerable to CVE-2026-59890. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-59890...

openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing

A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application ...

openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing

A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application ...

SUSE CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

SUSE CVE-2026-19953

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in August 2026. Vulnerability Details CVEID:CVE-2026-12590 DESCRIPTION: Impact: In body-parser versions prior to 1.20.6...

Injection fast-uri Dependency in Jira Service Management Data Center

This High severity Injection vulnerability was introduced in versions 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This Injection vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

Injection fast-uri Dependency in Jira Software Data Center

This High severity Injection vulnerability was introduced in versions 10.2.1, 10.3.0, 10.4.0, 10.5.1, 10.6.0, 10.7.2, 11.0.0, 11.1.0, 11.2.1, and 11.3.0 of Jira Software Data Center. This Injection vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2026-15603

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote client can inject specific Unicode line separator characters into log token values. This manipulation can cause downstream log processing systems to misinterpret a single log entry as multiple...

CVE-2026-13723

A flaw was found in electron-builder. An attacker can exploit a Unicode Normalization Collision, combined with symlink following behavior, within the zipx.Unzip extraction routine. By crafting a malicious ZIP archive, the attacker can cause the application to treat certain Unicode equivalent...

EUVD-2026-68681

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...