Multiple Libraries Hit By Vulnerabilities

A stack-based buffer overflow vulnerability in Libmodbus versions prior to 3.1.10 (CVE-2024-10918) allows an attacker to overwrite memory by sending a Modbus request with an unexpected length. This could lead to a crash or potential code execution. The vulnerability arises from improper handling of response buffer allocation when a malformed request is received. Users should update to a patched version to mitigate this risk.

Multiple vulnerabilities have been disclosed in the Axios JavaScript HTTP client, affecting various versions and configurations. These include prototype pollution flaws (CVE-2026-67314, CVE-2026-67319, CVE-2026-67320, CVE-2026-67321), which could allow attackers to modify request behavior or inject malicious data if other prototype pollution vulnerabilities are present. Additionally, issues with maxBodyLength enforcement in HTTP/2 requests (CVE-2026-67316) and streamed bodies (CVE-2026-67317) could enable attackers to send oversized requests. Bypassing proxy configurations via loopback address manipulation (CVE-2026-67315) and uncontrolled recursion in form data serialization (CVE-2026-67313, CVE-2026-67312) are also noted. Users are advised to update Axios to the latest versions to address these security concerns.

Several vulnerabilities have been identified in guzzlehttp/guzzle, a PHP HTTP client. Versions prior to 7.15.1 suffer from improper handling of cookie scopes (CVE-2026-67355), potentially exposing host-only cookies. A denial-of-service vulnerability (CVE-2026-67353) exists in the CookieJar due to a lack of restrictions on Set-Cookie header fields, which could be exploited by returning numerous large cookies. An information disclosure vulnerability in RedirectMiddleware (CVE-2026-67354) could leak URI fragments in referer headers. Furthermore, versions before 7.14.2 fail to isolate Proxy-Authorization headers (CVE-2026-67339), potentially exposing proxy credentials to origin servers. Updating to patched versions is recommended.

A stored cross-site scripting (XSS) vulnerability in JupyterLab's Extension Manager (CVE-2026-67338) allows attackers to inject malicious code by including javascript: URIs in package metadata URLs. This could lead to arbitrary code execution within the user's browser context when malicious extensions are published and installed. Users should update JupyterLab to version 4.5.9 or later to patch this vulnerability.

GitPython, a Python library for interacting with Git repositories, has several vulnerabilities. Versions before 3.1.50 fail to validate newline characters in configuration parameters (CVE-2026-67326), enabling attackers to inject arbitrary section headers into .git/config files. A separate issue in version 3.1.50 (CVE-2026-67324) involves improper handling of short-option forms, potentially leading to unintended behavior. Additionally, versions before 3.1.51 are vulnerable to command injection through dangerous Git options passed to Repo.archive() and git.ls_remote() (CVE-2026-67323). Updating GitPython to the latest versions is advised.