What you need to know today.
Libmodbus, Axios, Guzzle, JupyterLab, and GitPython disclose multiple vulnerabilities including buffer overflows, prototype pollution, and command injection.
A stack-based buffer overflow vulnerability in libmodbus versions prior to 3.1.10 (CVE-2024-10918) allows an attacker to overflow a buffer allocated for Modbus responses. This occurs when the function attempts to reply to a Modbus request with an unexpected length, potentially leading to denial-of-service or code execution. The vulnerability arises from insufficient validation of the Modbus response length.
Multiple vulnerabilities have been disclosed in Axios, a popular JavaScript HTTP client, affecting various versions and configurations. These include prototype pollution flaws (CVE-2026-67314, CVE-2026-67319, CVE-2026-67320, CVE-2026-67321), which can allow attackers to alter request construction or bypass security measures if the Object.prototype has already been compromised. Other issues involve improper handling of maxBodyLength limits for streamed or HTTP/2 requests (CVE-2026-67316, CVE-2026-67317), bypassing proxy rules via loopback address misinterpretation (CVE-2026-67315), and uncontrolled recursion in form data serialization (CVE-2026-67312, CVE-2026-67313). These vulnerabilities, primarily impacting Node.js environments, could lead to request manipulation, denial-of-service, or information disclosure depending on the specific flaw and exploitation context.
Several security weaknesses have been identified in Guzzle, a PHP HTTP client library. CVE-2026-67355 details a flaw where the CookieJar fails to preserve host-only cookie scope, potentially exposing sensitive cookies. CVE-2026-67353 highlights a denial-of-service vulnerability due to unrestricted Set-Cookie header fields, allowing attackers to overwhelm the server with excessive cookies. Additionally, CVE-2026-67354 points to an information disclosure vulnerability in RedirectMiddleware that can leak URI fragments in referer headers, and CVE-2026-67339 describes an issue where Proxy-Authorization headers are not properly isolated, potentially exposing proxy credentials to origin servers.
A stored cross-site scripting (XSS) vulnerability in JupyterLab's Extension Manager (CVE-2026-67338) allows attackers to inject malicious code by publishing PyPI packages with javascript: URIs in project metadata. This flaw fails to validate URI protocols, enabling attackers to execute arbitrary scripts within the context of a user's JupyterLab session when the malicious extension is installed or its metadata is viewed.
GitPython, a Python library for interacting with Git repositories, has several vulnerabilities. CVE-2026-67326 allows attackers to inject arbitrary section headers into .git/config by exploiting newline character validation issues in config_writer(). CVE-2026-67324 fails to properly validate certain short-option forms, potentially allowing unsafe Git options to be passed. Furthermore, CVE-2026-67323 describes a command injection vulnerability in Repo.archive() and git.ls_remote() due to insufficient guarding against dangerous Git options passed as keyword arguments, enabling arbitrary command execution on the underlying system.