CVE-2026-121821 is a medium severity vulnerability in LY Corporation's Armeria framework versions 0.84.0 through 1.42.0. It involves permissive Cross-Origin Resource Sharing (CORS) policies that fail to enforce configured path restrictions. This allows attacker-controlled websites visited by authenticated users to read sensitive responses from paths that should be excluded when credentials are enabled.
CVE-2026-121820 is a high-severity vulnerability in LY Corporation's Armeria library (armeria-saml) prior to version 1.43.0. The flaw involves improper handling of highly compressed SAML messages in the HTTP-Redirect binding decoder, which decompresses attacker-supplied data without limiting the output size before signature validation. This can allow an unauthenticated remote attacker to exhaust server memory, resulting in a denial of service.
CVE-2026-121819 is a medium severity vulnerability in LY Corporation's Armeria library, specifically in armeria-xds versions 1.40.0 through 1.42.0. The issue arises because DataSourcePolicy does not resolve symbolic links when checking filename containment, allowing an attacker controlling or partially controlling the xDS control plane to cause the client to read files outside the intended root directories. This can lead to exposure of header-compatible text secrets in deployments using a credential injector. The vulnerability is fixed in version 1.43.0.
The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.
The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.
CVE-2026-120749 is a denial of service vulnerability in D-Bus on Red Hat Enterprise Linux 10. An unprivileged local user can cause the dbus-daemon to abort when a driver-originated broadcast message cannot be delivered to a recipient, triggering an assertion failure. This issue arises when a privileged monitoring client is attached and is a residual problem from an incomplete fix for CVE-2023-34969. No fixed release has been published yet.
CVE-2026-83494 is a vulnerability in the training-operator component of Red Hat OpenShift AI (RHOAI). It involves an incorrect object casting in the PyTorchJob ValidateUpdate webhook that allows authenticated users to bypass an immutability check. This flaw can enable users to detach a queued job from quota management or hijack a running job's controller ownership, primarily causing a denial of service (DoS) condition. Currently, no mitigation or fix meeting Red Hat's criteria is available.
A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository.
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.
CVE-2026-73473 is a vulnerability in GStreamer's gst-plugins-good (avidemux) where missing validation of the subindex parser's entry count can lead to excessive memory allocation and denial of service. This flaw can be triggered by opening or previewing a crafted AVI file, as avidemux is auto-plugged by common GStreamer components. The issue is fixed in version 1.28.6.
CVE-2026-73472 is an integer overflow vulnerability in the GStreamer gst-plugins-good component (avidemux). The flaw occurs in the superindex and subindex parsers, allowing integer overflow to bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by common GStreamer elements like playbin, decodebin, and gst-discoverer, simply opening or previewing a crafted AVI file can trigger the issue. The vulnerability can cause application crashes leading to denial of service or limited memory disclosure but does not enable arbitrary code execution or privilege escalation under default settings. The issue is fixed in gst-plugins-good version 1.28.6.
A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
A vulnerability in Keycloak's token sanitization logic allows attackers with client registration privileges or a valid Initial Access Token to inject forged client roles into security tokens. This occurs because the sanitization process fails to recognize Jackson JSON objects, enabling unauthorized role mappings. Exploitation could lead to unauthorized access to protected resources. No official patch or mitigation currently meets Red Hat's criteria for ease of use and applicability.
A vulnerability in the Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before version 6.91 allows unauthenticated users to inject arbitrary web scripts via a commenter-supplied value. This value is not properly escaped before being displayed on an administrative spam-review screen, leading to potential cross-site scripting (XSS) attacks against administrators reviewing flagged comments.
A vulnerability in the Dynamic Client Registration component of Keycloak allows an attacker with valid registration credentials to create a client that maps standard user profile claims to sensitive security roles. This can lead to unauthorized privilege escalation on external applications that trust Keycloak tokens. The flaw stems from insufficient restriction on claim names during client setup. Exploitation requires valid initial access tokens and impacts external relying parties that use token claims for authorization. No official fix or mitigation meeting Red Hat's criteria is currently available.