Open-Source Libraries Hit By Multiple Critical Flaws
A wave of critical vulnerabilities impacts open-source libraries including Pypi's pulpcore, libssh, and Keras, with flaws ranging from directory traversal to arbitrary code execution.
A directory traversal vulnerability in Pypi's pulpcore, specifically in the relative_path_validator, allows for bypass via path manipulation, potentially leading to unauthorized access or modification of files. This is tracked as CVE-2026-12701.
In the libssh library, versions prior to 0.11.2 contain an out-of-bounds read vulnerability in the sftp_handle function due to an incorrect comparison check. This flaw could allow an attacker to access memory beyond valid bounds, potentially leading to information disclosure or crashes. This is CVE-2025-5318.
Keras, a popular deep learning library, has a critical vulnerability (CVE-2026-12484) that allows for arbitrary code execution through unsafe deserialization of PyTorch data. This could enable attackers to run malicious code on systems processing untrusted Keras models.
A privilege escalation flaw exists in Linux PAM (Pluggable Authentication Modules) where pam_namespace may improperly handle user-controlled paths. Local users can exploit this through symlink attacks and race conditions to gain root privileges, identified as CVE-2025-6020.
Libarchive, a library for reading and writing various archive formats, has a vulnerability in its archive_read_format_rar_seek_data() function. An integer overflow can lead to a double-free condition, potentially resulting in denial-of-service or arbitrary code execution. This is CVE-2025-5914.
PHP versions 8.0.x before 8.0.28, 8.1.x before 8.1.16, and 8.2.x before 8.2.3 are affected by a flaw in the password_verify() function. It may incorrectly accept certain invalid Blowfish hashes as valid, which could lead to authentication bypass if such hashes are stored in a password database. This is CVE-2023-0567.
Red Hat's libxslt library has a memory corruption vulnerability where attributes like atype and flags are modified incorrectly. This corruption impacts internal memory management, preventing proper processing of XSLT functions such as key(), potentially leading to crashes or unpredictable behavior. This is CVE-2025-7425, and it is mentioned in CISA ICS Advisories for Siemens Ruggedcom Rox and Siemens SIMATIC.
Rpcbind versions are affected by a stack buffer overflow in the rpcinfo utility's rpcbaddrlist() function, tracked as CVE-2026-16277. This could allow for denial-of-service attacks.
Operator Framework versions prior to 0.15.2 provided an insecure script, user_setup, which could allow operator containers to run with excessive permissions by modifying /etc/passwd. This is CVE-2025-7195.
A flaw in rsync (CVE-2024-12085) allows for potential information leakage. When comparing file checksums, an attacker can manipulate the checksum length to cause a comparison with uninitialized memory, potentially revealing sensitive data.
FreeRDP, a remote desktop protocol client, has a double-free vulnerability (CVE-2026-64621) triggered by a crafted .rdp file, which could lead to remote code execution.
GLib versions are vulnerable to an integer overflow in the g_string_insert_unichar() function (CVE-2025-4373). When inserting a character at a large position, the position can overflow, leading to a buffer underwrite and potential crashes or memory corruption.
Quay's claircore component has a denial-of-service vulnerability (CVE-2026-16254) in its apk installed-database parser due to an out-of-bounds slice access.
Apache HTTP Server and related software using Expat versions prior to 2.0.1 are affected by a denial-of-service vulnerability (CVE-2009-3720) in the updatePosition function of libexpat. This can be triggered by a specially crafted XML document.
Legion Of The Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM has an out-of-bounds write vulnerability (CVE-2026-15997) that could lead to buffer overflows.
ProFTPD's mod_sftp contains a heap-based buffer overflow (CVE-2026-53994) in the fxp_packet_read() function, which can be exploited by authenticated SFTP users.
Busybox versions 1.38.0 are affected by a use-after-free vulnerability in the awk_sub() function (CVE-2026-38753) and a heap overflow in the ifsbreakup() function (CVE-2026-38754), both leading to denial-of-service conditions.