Threat database

Red Hat has issued a security advisory for nodejs22 addressing multiple vulnerabilities in Node.js, including unauthorized filesystem access due to a permission model enforcement flaw, remote memory exhaustion via HTTP/2 retained header blocks, and a heap-use-after-free in HTTP/2 handling that can cause denial of service. These vulnerabilities affect Node.js as packaged in Red Hat Enterprise Linux 10 and related variants. The update is rated as Important by Red Hat Product Security.

CVE-2026-17527 is a vulnerability in Red Hat OpenShift Virtualization v4.18 related to the containerized-data-importer (CDI) component. The aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access, improperly grants create permission on the datavolumes/source subresource. This allows a user or service account with view role and write access to any namespace to clone and exfiltrate the contents of any PersistentVolumeClaim (PVC) across namespaces, bypassing namespace isolation and read-only guarantees.

Two security vulnerabilities have been identified in nginx version 1.26 used in Red Hat Enterprise Linux 9. These include a heap buffer over-read that can lead to memory modification or denial of service (CVE-2026-56434), and a memory disclosure and denial of service issue in the ngx_http_slice_module (CVE-2026-60005). Red Hat has released security updates addressing these issues.

Multiple security vulnerabilities have been identified in WebKitGTK, the GTK port of the WebKit web rendering engine. These include arbitrary JavaScript execution in PDF.js, unexpected process crashes, memory corruption, sandbox escape, sensitive data leakage, clipboard hijacking, and disclosure of process memory. These issues arise from maliciously crafted web content and pose risks such as denial of service, information disclosure, and potential privilege escalation. Red Hat has released security updates addressing these vulnerabilities in webkit2gtk3 for Red Hat Enterprise Linux 8.8 variants.

A local privilege escalation vulnerability exists in the kbd package used in Red Hat Enterprise Linux 9. The flaw in openvt involves incorrect process owner verification, which could allow an unprivileged local user to gain root access without a password. Red Hat has released an update to address this issue.

Red Hat has issued a security advisory for the unbound DNS resolver addressing two vulnerabilities: a cache poisoning flaw due to insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690), and a denial of service vulnerability triggered by a malformed EDNS Report-Channel option (CVE-2026-55973). These issues affect Red Hat Enterprise Linux 10 and related products. The update fixes these vulnerabilities to prevent potential cache poisoning and denial of service attacks.