Threat database

Two denial of service vulnerabilities have been identified in the Qt software toolkit's qt5-qtbase packages, specifically related to XML serialization and XML parsing. These vulnerabilities could allow an attacker to cause a denial of service via uncontrolled recursion during XML processing. Red Hat has issued a security advisory and released updates for affected Red Hat Enterprise Linux 8.4 versions to address these issues.

CVE-2026-124560 is a critical heap-based buffer overflow vulnerability in the D-Link DIR-878 router, specifically in version 1.20B05. The flaw exists in the GetCAPTCHAsetting function of the HNAP Handler component, where manipulation of the uid argument can trigger the overflow. This vulnerability can be exploited remotely without authentication. The affected product is no longer supported by the vendor. Public exploit code is available, increasing the risk of exploitation.

Effekseer, a particle effect editing tool, has a vulnerability due to improper validation of input data that may lead to an out-of-bounds read.

OpenAM Consortium Edition versions 14.0.5 and earlier contain an open redirect vulnerability in the Liberty ID-FF service provider single sign-on flow. The vulnerability arises because the 'goto' parameter is used without validation to redirect users after authentication, potentially allowing attackers to redirect users to arbitrary websites. This affects deployments where Liberty ID-FF hosted service provider is configured, which is not enabled by default. The issue is fixed in version 14.0.6 by disabling the legacy Liberty ID-FF endpoints.

This advisory addresses multiple security vulnerabilities in the Red Hat Enterprise Linux 9.6 kernel live patch module for kernel version 5.14.0-570.116.1.el9_6. The vulnerabilities include improper validation of DAC offset pointers in SMB client code, improper allocation limits in IPC next_id, a potential use-after-free in UDP tunnel segmentation, and unbounded receive headroom in the network tunnel driver. These issues have been fixed in updated kpatch-patch modules.

A denial of service vulnerability exists in the Ruby resolv gem due to uncontrolled memory growth triggered by crafted DNS responses. This issue affects Ruby as packaged in Red Hat Enterprise Linux Server Extended Life Cycle Support 7. The vulnerability is identified as CVE-2026-80212 and has been rated with a high severity impact by Red Hat Product Security. A security update addressing this issue is available for affected Red Hat products.

A heap buffer overflow vulnerability exists in the RainerScript replace() function of the rsyslog daemon, which can lead to a denial of service. This issue affects Red Hat Enterprise Linux 7 Extended Lifecycle Support versions. Red Hat has issued a security advisory and released updated packages to address this vulnerability.

A security vulnerability (CVE-2026-13732) in the GNU Debugger (GDB) affects Red Hat Enterprise Linux 10.0 Extended Update Support and related variants. The flaw is an out-of-bounds write in the STABS parser function read_member_functions() triggered by crafted ELF files. Red Hat has issued an important security advisory with updated packages to address this issue.

Red Hat OpenShift Container Platform 4.18.60 includes a security update addressing a vulnerability in the openshift-ansible installer container. The installer downloads and executes a remote inventory script without verifying its integrity, which could lead to security risks. Users of OpenShift Container Platform 4.18 are advised to upgrade to the updated packages and images provided in this release to mitigate the issue.

CVE-2026-124558 is a server-side request forgery (SSRF) vulnerability in DataLinkDC Dinky versions 1.2.0 through 1.2.5. The flaw exists in the SqlGateway.onOpen function within the sql-gateway Endpoint component, where manipulation of the connectAddress argument allows remote attackers to induce the server to make unintended requests. Public exploit code has been disclosed, increasing the risk of exploitation. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.

A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability. No specific affected versions or technical details are provided. There is no information about patches or exploits in the wild.

Multiple security vulnerabilities have been identified in the Ruby programming language, including a double free issue and several integer overflow issues in the regular expression parser and compiler. These vulnerabilities affect Ruby as packaged in Red Hat Enterprise Linux 9.8 Extended Update Support and related Red Hat products. The issues have been rated with moderate severity by Red Hat Product Security. Updates addressing these vulnerabilities are available through Red Hat advisories.

Red Hat OpenShift Container Platform 4.19.55 includes critical security updates addressing two vulnerabilities: CVE-2026-98432, a kernel IPv4 issue involving freeing inet_opt and ireq_opt after an RCU grace period, and CVE-2026-111497, an out-of-bounds write vulnerability in the Google Brotli decoder. Users of OpenShift Container Platform 4.19 are advised to upgrade to this release to mitigate these issues. Detailed upgrade instructions and release notes are provided by Red Hat.

The kafbail npm package versions 2.0.12, 2.0.13, and 2.0.14 contain malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.

CVE-2026-124556 is an open redirect vulnerability in kekingcn kkFileView versions 5.0.0 through 5.0.3. The flaw exists in the BaseUrlFilter.getBaseUrl function, where manipulation of the X-Base-Url argument allows an attacker to redirect users to arbitrary external URLs. The vulnerability can be exploited remotely and requires user interaction. Public exploit code has been disclosed, but no vendor response or patch is currently available.