Security advisories for LACT, libexpat, libksba and Perl components

Several open source components received security disclosures on 2026-09-01, spanning local privilege escalation, remote denial of service, and parser flaws. The reports cover a GPU daemon, XML and CMS libraries, and Perl modules used in web and hostname handling.

LACT Polkit bypass and temp file issues

The LACT GPU daemon has a Polkit authentication bypass and temporary file handling problems tracked as CVE-2026-75037 and CVE-2026-75038. These issues enable local root access. Systems running the daemon require prompt review of the disclosure and corresponding updates.

libexpat 2.8.4 fixes four vulnerabilities

libexpat 2.8.4 addresses four vulnerabilities, including a CVSS 7.5 remote denial of service. The library serves as a widely used XML parser. Dependent projects should upgrade to limit exposure to the fixed flaws.

libksba 1.8.1 closes CMS parser infinite loop

Libksba 1.8.1 resolves a possible infinite loop in its CMS parser under tracker T8361. The flaw was identified via a Red Hat partnership. Cryptographic software relying on libksba needs the updated release.

Perl URI punycode encoding flaw

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels through missing nameprep normalization, assigned CVE-2026-19953. The behavior produces incorrect hostname results. Applications handling internationalized domains with this module should move to 5.36 or later.

Plone restapi moderate fixes

Plone published security advisory 20260831 with two moderate-severity fixes in plone.restapi for method invocation and information disclosure. Version pins accompany the changes. Operators of Plone sites should apply the specified updates.

HTML::FormFu unbounded repeat DoS

HTML::FormFu versions through 2.08 for Perl permit resource exhaustion from an unbounded repeat count supplied in the query string for Repeatable elements, under CVE-2026-19873. The condition enables denial of service. Sites using the library for form handling must upgrade past 2.08.