Multiple security vulnerabilities have been identified and fixed in Dovecot, an IMAP and POP3 server for Linux and UNIX-like systems. The issues include denial of service via various vectors such as IMAP ID command, crafted email headers, ManageSieve login and arguments, connection limit exhaustion, and a use-after-free leading to arbitrary code execution. Additionally, an authentication bypass via incorrect OAuth2 token validation and a MySQL multi-byte escaping flaw were addressed. These vulnerabilities affect Red Hat Enterprise Linux 8 and related products. The update also fixes a crash related to mailbox access. The vendor has released patches to address these issues.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol. These include denial of service issues via crafted commands and out-of-bounds reads, as well as remote code execution vulnerabilities due to heap buffer overflows and uninitialized heap memory disclosure. The vulnerabilities affect Red Hat Enterprise Linux 8 and related products. Red Hat has issued an important security update addressing these issues.
A vulnerability in virtualenv allows prompt values to be written into the pyvenv.cfg configuration file without sanitizing line boundaries. This can lead to configuration injection, potentially affecting the behavior of the virtual environment.
A denial of service (DoS) vulnerability exists in Axios, a widely used HTTP client library, due to inefficient regular expression handling of crafted data URLs with repeated slashes. This flaw can cause synchronous CPU exhaustion on Node.js services, freezing the event loop and making services unresponsive. The issue affects Red Hat Hardened Images RPMs that include Axios versions prior to the patched release. Red Hat has issued an update including grafana13.1-13.1.6-0.6.hum1 to address this vulnerability.
A security vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP), allows remote code execution or causes client crashes when connecting via a malicious TS Gateway. This issue is tracked as CVE-2026-55193 and affects Red Hat Enterprise Linux 7 Extended Lifecycle Support versions. Red Hat has issued a security update to address this vulnerability.
A vulnerability in Qt's QDomDocument serialization (QtXml) allows remote attackers to cause a denial of service by providing deeply nested untrusted XML, leading to uncontrolled recursion and stack exhaustion. This flaw affects applications using the QtXml module to serialize XML documents. The impact is limited to service availability with no risk of code execution or data compromise. Red Hat has issued an advisory for Red Hat Hardened Images RPMs including qt6-qtbase packages but has not yet released a fix. Mitigation involves avoiding processing untrusted XML or implementing robust input validation and sanitization at the application level.
CVE-2026-88771 is a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway. Exploitation involves attacker-controlled usernames triggering command execution, payload retrieval, reverse shell deployment, web shell installation, privileged account creation, and attempted exfiltration of configuration data. Two second-stage payloads, main.py and update_c08937.pl, facilitate persistent access and data theft. Post-exploitation artifacts include creation of superuser accounts and system binary modifications. Public exploit code is available via Metasploit. No patch or remediation details are provided.
On August 31, 2026, threat actors exploited two zero-day vulnerabilities in PaperCut MF version 24.0.2, targeting an internet-facing print server in the Education sector. The attackers deployed an in-memory Java loader to establish a web shell, through which they delivered a trojanized Microsoft Copilot binary containing an AdaptixC2 implant. This implant connected to command-and-control infrastructure hosted on Alibaba servers. After a dormant period, the attackers performed reconnaissance and Active Directory enumeration, stole a token from a domain-privileged service account, and moved laterally to a domain controller. On the domain controller, they dumped credentials, enabled Windows Restricted Admin mode for pass-the-hash attacks, and extracted the NTDS.dit database, achieving full domain compromise.
A malicious actor exploited a Citrix NetScaler Gateway zero-day vulnerability on September 24, 2026, three days before public disclosure. The attacker attempted to establish persistence using a password-protected webshell and tried to escalate privileges by setting setuid and setgid bits on /bin/sh. The attack involved disguising a PHP webshell as a CSS file and manipulating web server aliases to evade detection. Although the targeted sensor was not compromised, the attack demonstrated sophisticated post-exploitation techniques for maintaining access and evading detection.
This Red Hat security advisory addresses two vulnerabilities in Ruby 2.5 and related gems. The first vulnerability (CVE-2026-80212) affects the resolv gem, allowing denial of service via uncontrolled memory growth from crafted DNS responses. The second vulnerability (CVE-2026-88030) affects the rubygem-mongo MongoDB Ruby driver, enabling data disclosure and denial of service through query-operator injection. Red Hat has released updates for Ruby 2.5 modules on Red Hat Enterprise Linux 8 to remediate these issues.
Multiple security vulnerabilities have been identified in GIMP, the GNU Image Manipulation Program, including heap and stack buffer overflows, integer overflows, and arbitrary code execution risks in various image file parsers and plugins such as PSD, TIF, APNG, FITS, and SGI. These vulnerabilities could allow remote code execution or cause crashes when processing crafted image files. Red Hat has issued an important security update for GIMP in Red Hat Enterprise Linux 9.6 Extended Update Support to address these issues.
Multiple remote code execution vulnerabilities have been identified in the GStreamer streaming media framework, specifically within the gstreamer1-plugins-good package. These include heap-based buffer overflows in MRF and PNG file parsing, as well as a use-after-free vulnerability in the rtpsbcdepay component. The vulnerabilities affect Red Hat Enterprise Linux 8.4 Extended Life Cycle Long Life and related variants. Red Hat has issued security updates addressing these issues.
This advisory addresses two security vulnerabilities in the Red Hat Enterprise Linux 9.2 kernel live patch module for kernel-5.14.0-284.134.1.el9_2. The first vulnerability (CVE-2026-46189) is a double free error in the RDMA/vmw_pvrdma component during the pvrdma_alloc_ucontext() error path. The second vulnerability (CVE-2026-74581) is a use-after-free in the IPv6 networking code due to a stale pointer in fib6_rule_suppress. Both issues could lead to kernel memory corruption. Red Hat has released live patch updates to address these vulnerabilities.
This advisory addresses multiple security vulnerabilities in the Red Hat Enterprise Linux 8.8 kernel live patch module for kernel-4.18.0-477.130.1.el8_8. The issues include double free vulnerabilities in the RDMA/rxe and RDMA/vmw_pvrdma components, and a use-after-free vulnerability in the IPv6 networking code related to fib6_rule_suppress. These flaws could lead to memory corruption and potential system instability or exploitation. Red Hat has released updated kpatch modules to fix these vulnerabilities.