Angular, PostCSS, SSSD Vulnerabilities Disclosed
Angular, PostCSS, and SSSD face multiple vulnerabilities including XSS, DoS, and information disclosure risks.
A denial-of-service vulnerability in the npm package brace-expansion (CVE-2026-69152) allows attackers to crash applications by sending specially crafted input that triggers an unbounded intermediate array. This could lead to application instability and denial of service. The vulnerability exists in versions prior to 1.0.5.
Cross-Site Scripting (XSS) vulnerabilities have been discovered in Angular, affecting the @angular/compiler and @angular/core packages (CVE-2026-69151). Attackers can exploit these flaws through internationalization event handlers, potentially leading to the execution of arbitrary scripts in users' browsers. The vulnerability is present in versions prior to 17.3.0.
A critical vulnerability in Angular's @angular/common package (CVE-2026-68945) allows for Cross-Request Response Reuse and State Poisoning within the HttpTransferCache. This could enable attackers to manipulate cached responses and potentially poison the state of legitimate user sessions, leading to unauthorized actions or information disclosure. Versions prior to 17.3.0 are affected.
PostCSS, a CSS post-processor, has a vulnerability (CVE-2026-69153) that could lead to information disclosure. By crafting a malicious source map, an attacker might trick a PostCSS processor into revealing sensitive information. This issue affects versions prior to 8.1.0.
Multiple vulnerabilities have been identified in SSSD (System Security Services Daemon). CVE-2026-68742 and CVE-2026-68743 involve out-of-bounds reads in the NSS and PAM responders, respectively, due to unchecked lengths in network communications. Additionally, CVE-2026-68744 details an uninitialized heap disclosure in the NSS responder. These flaws could lead to information disclosure or potential denial of service.
A vulnerability in 389-ds-base (CVE-2026-18651) allows an attacker to bypass account lockouts. The SASL PLAIN bind mechanism installs connection credentials before checking the account lock status, enabling continued access even after an account has been locked. This could facilitate unauthorized access to systems.
A heap-based buffer overflow vulnerability exists in FreeRDP (CVE-2026-68579) within the Windows clipboard client's CliprdrStream_Read function. This flaw could be triggered when an OLE paste consumer, such as Windows Explorer, attempts to read data from the clipboard, potentially leading to a crash or remote code execution. Versions prior to 3.30.0 are affected.
An unspecified vulnerability was found in the Jinja Minja Template Parser component of ggml-org llama.cpp (CVE-2026-18581). The vulnerability is related to the file common/jinja/parser.cpp and could be triggered by manipulating input, potentially leading to unintended behavior or security compromise.