shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.

Chromium: CVE-2026-3063 Inappropriate implementation in DevTools

Chromium: CVE-2026-3062 Out of bounds read and write in Tint

Chromium: CVE-2026-3061 Out of bounds read in Media

BIND 9 server memory exhaustion during GSS-API TKEY negotiation

node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

NATS Server panic via malicious compression on leafnode port

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Apache HTTP Server: mod_proxy_ftp XSS

Apache HTTP Server: mod_dav_lock indirect lock crash

Apache HTTP Server: mod_md unrestricted OCSP response

Apache HTTP Server: mod_ldap per-dir use-after-free

systemd: Local unprivileged user can trigger an assert

Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver

ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

NGINX ngx_stream_ssl_module vulnerability

NGINX ngx_mail_proxy_module vulnerability

FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions