What you need to know today.
Keras and FreeRDP RCE flaws, Linux PAM privilege escalation, and pulpcore directory traversal lead today's disclosures.
A double-free vulnerability in FreeRDP, triggered by a crafted .rdp file, could lead to remote code execution. This flaw, identified as CVE-2026-64621, impacts FreeRDP and poses a significant risk to systems relying on this remote desktop protocol client. Exploitation could allow an attacker to gain control of the affected system. Users should update to a patched version as soon as possible.
An arbitrary code execution vulnerability exists in Keras due to unsafe deserialization of PyTorch data, identified as CVE-2026-12484. This flaw allows an attacker to execute arbitrary code on a system by providing a specially crafted PyTorch data file to a vulnerable Keras application. This is particularly concerning in environments where user-provided data is processed. Prompt patching or input validation is recommended.
A directory traversal vulnerability in pulpcore's relative_path_validator could allow an attacker to bypass security controls and access arbitrary files on the system, as detailed in CVE-2026-12701. This vulnerability, affecting pulpcore, could lead to unauthorized information disclosure or further system compromise. It is crucial for users to apply available patches to mitigate this risk.
A privilege escalation flaw in Linux PAM (Pluggable Authentication Modules) allows local users to gain root privileges. CVE-2025-6020, affecting pam_namespace, can be exploited through symlink attacks and race conditions, enabling attackers to manipulate user-controlled paths. This is a critical vulnerability for any system using PAM, as it undermines local access controls.
Libssh versions prior to 0.11.2 contain an out-of-bounds read vulnerability in the sftp_handle function. CVE-2025-5318 arises from an incorrect comparison check, allowing an attacker to read memory beyond the allocated buffer. This could lead to information disclosure or potentially be leveraged for further exploitation.
An integer overflow in libarchive's archive_read_format_rar_seek_data() function can lead to a double-free condition, as described in CVE-2025-5914. This vulnerability could be exploited to cause a denial-of-service or potentially achieve arbitrary code execution. Systems using libarchive should be updated to a secure version.
PHP versions 8.0.x before 8.0.28, 8.1.x before 8.1.16, and 8.2.x before 8.2.3 are affected by a flaw in the password_verify() function. CVE-2023-0567 allows certain invalid Blowfish hashes to be accepted as valid. If such a hash is stored in a password database, it could lead to authentication bypass.
A vulnerability in libxslt, CVE-2025-7425, allows modification of attribute types and flags, corrupting internal memory management. This corruption can prevent proper processing of XSLT functions, potentially leading to denial-of-service or other unintended behavior. This advisory was highlighted in CISA ICS Advisories concerning Siemens devices.
Rsync versions are affected by CVE-2024-12085, where a flaw during file checksum comparison could lead to memory leaks. An attacker can manipulate checksum lengths, causing comparisons with uninitialized memory. This information disclosure could aid attackers in further compromising systems.
A stack buffer overflow in rpcinfo's rpcbaddrlist() function within rpcbind, identified as CVE-2026-16277, could allow an attacker to crash the service or potentially execute arbitrary code.
Operator-SDK versions before 0.15.2 provided an insecure script (user_setup) that modified file permissions, potentially allowing operator containers to run with elevated privileges in environments using random UIDs. This is tracked as CVE-2025-7195.
A flaw in GLib's g_string_insert_unichar() function, CVE-2025-4373, involves an integer overflow that can lead to a buffer underwrite, potentially causing crashes or other memory corruption issues.
Claircore's APK installed-database parser has an out-of-bounds slice vulnerability, CVE-2026-16254, which can be exploited to cause a denial-of-service.
The Apache HTTP Server is affected by CVE-2009-3720, a denial-of-service vulnerability in the updatePosition function of libexpat, which can be triggered by a crafted XML document.
Legion Of The Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM is vulnerable to an out-of-bounds write, CVE-2026-15997, which could allow for buffer overflows.
ProFTPD's mod_sftp contains a heap-based buffer overflow in the fxp_packet_read() function, CVE-2026-53994, which can be triggered by an authenticated SFTP user.
Busybox versions 1.38.0 are affected by a use-after-free vulnerability in the awk_sub() function (CVE-2026-38753) and a heap overflow in the ifsbreakup() function (CVE-2026-38754), both leading to denial-of-service conditions.