CVE-2026-14895

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s$//u. Because \s matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex...

PYSEC-2026-1756 PaddlePaddle command injection in paddle.utils.download._wget_download

Command injection in paddle.utils.download.wgetdownload bypass filter in paddlepaddle/paddle 2.6.0...

The vulnerability of the zmqsend utility in the FFmpeg multimedia library allows a hacker to induce a service failure.

The vulnerability of the zmqsend utility in the FFmpeg multimedia library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

EUVD-2026-25012

mv: symlinks expanded during cross-device move resource exhaustion / data duplication...

cp: -R reads device nodes as streams, destroying device semantics

The cp utility in uutils coreutils, when performing recursive copies -R, incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are...

EUVD-2026-24979

comm: FIFO/pipe inputs are drained before comparison data loss / hang...

GHSA-3WFC-MGPM-9RQ6 comm: FIFO/pipe inputs are drained before comparison (data loss / hang)

The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The arefilesidentical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input pat...

id: pretty-print uses effective GID instead of effective UID for name lookup

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleadi...

GHSA-XV5W-CW7X-72GJ id: pretty-print uses effective GID instead of effective UID for name lookup

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleadi...

EUVD-2026-25017

kill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes system crash / DoS...

EUVD-2026-24994

install -D: symlink race in directory creation allows arbitrary file overwrite...

EUVD-2026-24973

cut: -s only-delimited ignored when delimiter is a newline...

cut: -s (only-delimited) ignored when delimiter is a newline

The cut utility in uutils coreutils incorrectly handles the -s only-delimited option when a newline character is specified as the delimiter. The implementation fails to verify the onlydelimited flag in the cutfieldsnewlinechardelim function, causing the utility to print non-delimited lines that...

GHSA-WV33-5PXH-R7J7 cut: -s (only-delimited) ignored when delimiter is a newline

The cut utility in uutils coreutils incorrectly handles the -s only-delimited option when a newline character is specified as the delimiter. The implementation fails to verify the onlydelimited flag in the cutfieldsnewlinechardelim function, causing the utility to print non-delimited lines that...

EUVD-2026-25022

ln: rejects non-UTF-8 source filenames in target-directory mode...

GHSA-6GCW-W7CP-94G9 comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::fromutf8lossy, which replaces invalid UTF-8 byte sequences with the Unicode replacement character U+FFFD. This behavior differs from GNU comm, whic...

SUSE SLED15 / SLES15 Security Update : cifs-utils (SUSE-SU-2026:2699-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2699-1 advisory. This update for cifs-utils fixes the following issue - CVE-2026-12505: cifs.upcall local privilege escalation via...

EUVD-2026-41032

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php...

Global Buffer Overflow in GNU gzip

...

The vulnerability in the `io.netty.handler.codec.dns.DnsCodecUtil` component of the Netty framework, which is used for developing network applications, servers, and clients, allows a attacker to cause a service failure.

The vulnerability of the io.netty.handler.codec.dns.DnsCodecUtil component in the Netty framework, which is used for developing network applications, servers, and clients, relates to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a malicious...