Important: Red Hat Security Advisory: perl-XML-LibXML security update

An update for perl-XML-LibXML is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

CVE-2021-4034

CVE-2021-4034 $ make cc -Wall --shared -fPIC -o pwnkit.so pwnkit.c cc -Wall cve-2021-4034.c -o cve-2021-4034 echo "module UTF-8// PWNKIT// pwnkit 1" gconv-modules mkdir -p GCONVPATH=. cp /usr/bin/true GCONVPATH=./pwnkit.so:. $ ./cve-2021-4034 whoami root exit...

CVE-2021-21017

CVE-2021-21017 Not another Adobe Reader Byte Order Mark bug : IA32 plugin, ver. 2020.013.20074. char cdecl FUN2581894cchar baseurl,LPCSTR relurl ............................................................ ............................................................ if baseurl != char 0x0 && relu...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

GHSA-394H-QWMC-48PF virtualenv: Xonsh activation literals depend on the script decoding codec

Summary Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment. Affected area Xonsh reads a UTF-8 activation script using a legacy multibyte encoding...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to input validation bypass and data integrity issues in UltraJSON (CVE-2026-54911)

Summary IBM Watson Speech Services Cartridge is vulnerable to input validation bypass and data integrity issues in UltraJSON, due to a flaw that allows the encoder/decoder to accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of...

CLSA-2026-1790252195 expat: Fix of 3 CVEs

CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, by adding LITTLE2/BIG2ISINVALIDCHAR and the matching little2/big2isInvalid4 vtable entries to the UTF-16 tokenizers in lib/xmltok.c, so a lone high surrogate can no longer consume the following code unit as a...

CVE-2026-114114

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte coloffset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with...

Unity Linux 20.1070a Security Update: perl-XML-LibXML (UTSA-2026-141777)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141777 advisory. XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending...

Linux Distros Unpatched Vulnerability : CVE-2026-109950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched...

Linux Distros Unpatched Vulnerability : CVE-2026-109347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: expat (UTSA-2026-142303)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142303 advisory. Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can cra...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: expat (UTSA-2026-142355)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142355 advisory. Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can cra...

SUSE CVE-2026-110675

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

SUSE CVE-2026-110756

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-92480

A flaw was found in the Linux kernel's SCSI Universal Flash Storage UFS core. This vulnerability arises from improper validation of string descriptors, which can lead to an out-of-bounds read when processing UTF-16 payloads. A local attacker or a malicious UFS device could exploit this to...

Linux Distros Unpatched Vulnerability : CVE-2026-110675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey,...

CentOS Linux 6 [TuxCare] Security Update: expat / expat-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791333112)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791333112 advisory. - Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in...

CVE-2026-110675

A flaw was found in perl-Cpanel-JSON-XS. When the utf8 and allowbarekey configurations which are enabled by the relaxed setting are active, a quoted key is correctly validated as UTF-8, but a bare key's bytes are stored as a UTF-8 flagged string without any validation. Consequently, malformed...

CVE-2026-110688

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...