Threat database

A remote code execution vulnerability exists in OriginLab Origin Viewer when parsing OPJU files. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability has a high severity rating of 7.8 assigned by ZDI.

A remote code execution vulnerability exists in OriginLab Origin Viewer due to an out-of-bounds write in OGWU file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability has a high severity rating assigned by ZDI.

A stack-based buffer overflow vulnerability exists in OriginLab Origin Viewer when parsing OGWU files. This flaw allows remote attackers to execute arbitrary code on affected systems if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability is rated high severity with a CVSS score of 7.8 assigned by the Zero Day Initiative.

A remote code execution vulnerability exists in OriginLab Origin Viewer due to an out-of-bounds write in OGG file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability has a high severity rating of 7.8 assigned by ZDI.

A remote code execution vulnerability exists in OriginLab Origin Viewer due to an out-of-bounds write during OGG file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability has a high severity rating of 7.8 assigned by ZDI.

A memory corruption vulnerability in OriginLab Origin Viewer allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability is rated high severity with a CVSS score of 7.8 assigned by the Zero Day Initiative.

A remote code execution vulnerability exists in OriginLab Origin Viewer due to an out-of-bounds write in OGWU file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability is assigned CVE-2026-114567 with a high severity rating by ZDI.

A heap-based buffer overflow vulnerability in OriginLab Origin Viewer OPJ file parsing allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability is assigned CVE-2026-114568 with a high severity rating of 7.8 by ZDI.

A remote code execution vulnerability exists in OriginLab Origin Viewer when parsing OPJU files. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability is rated high severity with a CVSS score of 7.8 assigned by ZDI.

A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).

A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account.

The npm package '@kora20030101/test-pkg-delete-me' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is recommended, but due to the extent of the compromise, complete remediation may require rotating all secrets and keys from a different, uncompromised system.

CVE-2026-121837 is a vulnerability in the REST Data Panache component of Quarkus used by Red Hat Exploit Intelligence. It occurs when a security constraint is applied via the @SecureField annotation on a getter method instead of the field itself, causing the generated REST resource to improperly enforce filtering and sorting restrictions. This flaw allows authenticated users to infer sensitive data values by analyzing which records match filter criteria or their order, even though the sensitive values are not directly exposed in responses.

A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.

CVE-2026-114366 is an information disclosure vulnerability in the Qt Framework's QWebSocket authentication handling within the Qt WebSockets module. The flaw involves sensitive information not being properly removed before resource reuse, potentially exposing data. The vulnerability affects multiple Qt Framework versions prior to fixed releases. The CVSS score is low, indicating limited impact and exploitability.

Multiple security vulnerabilities have been identified and fixed in the Berkeley Internet Name Domain (BIND) software, which implements DNS protocols. These include memory exhaustion, denial of service, DNSSEC validation bypass, cache poisoning, unexpected server exits, and arbitrary code execution. The fixes are provided in an update for Red Hat Enterprise Linux 6 Extended Lifecycle Support. The advisory rates the security impact as Important and provides links for applying the update.

CVE-2026-119432 is a stored cross-site scripting (XSS) vulnerability in Foxit Workspace's file share preview feature. An attacker can upload a malicious file and share it with a victim. When the victim previews the file, the embedded script executes within the application's origin, potentially allowing access to locally stored credentials and enabling credential theft.

CVE-2026-119431 is a server-side request forgery (SSRF) vulnerability in Foxit Workspace's file-upload functionality. The vulnerability arises from insufficient validation of user-supplied links, which may allow a remote attacker to induce the server to access internal resources. This can lead to sensitive information disclosure and unauthorized access to internal services. The vulnerability has a high severity with a CVSS score of 7.7.

CVE-2026-119433 is a server-side request forgery (SSRF) vulnerability in an undocumented API endpoint of Foxit Workspace. It arises from insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this flaw to make the server send requests to arbitrary internal or external resources, potentially leading to unauthorized access to internal services, network reconnaissance, and disclosure of sensitive information.

CVE-2026-109518 is a vulnerability in the APT package manager affecting Ubuntu and Debian operating systems. When APT is configured to use HTTP package sources with retry settings enabled, an attacker positioned between the host and the package mirror could cause APT to install a package that bypasses verification. Fixed versions have been released by Canonical and Debian to address this issue.