CVE-2026-66338: Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
CVE-2026-66338 is a vulnerability in Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked(), rated Moderate by Microsoft, with a CVSS 3.1 base score of 5.4 (Medium). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.29% probability of exploitation activity in the next 30 days, higher than 22% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 3 products in 1 product family (Open Source Software).
CVE-2026-57968: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8)
CVE-2026-57973: Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability (Medium, CVSS 6.3)
CVE-2026-44210: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations (Critical, CVSS 9.9)
CVE-2026-15043: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text (Critical, CVSS 9.8)
CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout (Critical, CVSS 9.8)
CVE-2026-38968: ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing. (Critical, CVSS 9.8)
CVE-2026-53374: drm/amdgpu: zero-initialize GART table on allocation (Critical, CVSS 9.8)