CVE-2026-35343
The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimite
CVSS
3.3
Bajo
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Publicado: 22 abr 2026 · Última mod.: 26 oct 2026 · CWE-670
0.1%EPSS · 30 días0.1%
2026-09-282026-10-26
The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2020-372883.7 BAJ28.0%
——8Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.6dCVE-2026-796089.8 CRÍ28.4%
——9The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to better integrate with other manipulations of the same MSR.
In this rework an inverted conditional was introduced, resulting in the
workaround to not be applied when needed and vice versa.
For more details, see:
http://xenbits.xen.org/xsa/advisory-433.html7dCVE-2026-1097228.1 ALT24.1%
——7JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.11dCVE-2026-1072843.7 BAJ3.1%
——1The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installation and onOpen delivery. Frames coalesced with the invalid 101 response can be decoded and delivered from a peer that did not prove the handshake, although the request future fails and the channel closes. This issue is fixed in versions 3.0.12 and 2.16.1.19dCVE-2026-1065862.5 BAJ2.1%
——1In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.14dCVE-2026-1021246.5 MED10.8%
——3A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured during initial configuration.19d