A vulnerability in Apache Commons BCEL used by OpenJDK 8 allows symbolic names to be mapped incorrectly to classes. This occurs because BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, enabling subsequent lookups and verification to reference a different class. The issue affects multiple OpenJDK 8 versions and is fixed in Apache Commons BCEL version 6.13.0.
A vulnerability in Keycloak's OpenID Connect Device Authorization Grant flow allows bypassing multi-factor authentication (MFA) requirements. This flaw occurs because the flow does not enforce the minimum authentication level configured per client. An attacker with a stolen user's password can exploit this to gain unauthorized access to the Keycloak Admin REST API with the client's scoped roles. The issue is fixed in version 26.8.2.
A buffer overflow vulnerability exists in the libgd library used by Red Hat Enterprise Linux 8 when processing specially crafted GIF files. This flaw could allow code execution. Red Hat has released an important security update addressing this issue in libgd version 2.2.5-8.el8_10. The vulnerability affects multiple architectures of RHEL 8, including x86_64, IBM z Systems, Power little endian, and ARM 64. Users are advised to apply the provided update to remediate the vulnerability.
Multiple vulnerabilities have been identified in the Linux Kernel, which is the core component of the Linux operating system. The information provided is limited and does not specify the nature, impact, or affected versions of these vulnerabilities.
Multiple security vulnerabilities have been identified in the Skia graphics library component used by Google Chrome and Microsoft Edge browsers. These include use-after-free, cross-origin data disclosure, information disclosure, integer overflow, out-of-bounds read, memory corruption, and improper input validation issues. The vulnerabilities affect the WebKitGTK port used in Red Hat Enterprise Linux 9 and related distributions. A security update for webkit2gtk3 has been released by Red Hat to address these issues.
Multiple vulnerabilities have been identified in Langflow, an open-source visual interface for creating LLM-based applications. These vulnerabilities affect versions prior to 1.12.3 and version 1.12.3 itself. A fixed version, 1.12.3, has been released to address these issues.
A vulnerability in the Python multidict package versions from 6.7.0 up to 6.9.1 causes a reference leak in the C extension's items-view union and subtraction operations. This leak can lead to unbounded memory growth and denial of service when these operations are performed repeatedly on attacker-controlled sequences. The issue does not affect pure-Python builds or certain other operations and is fixed in version 6.9.1.
Multiple security vulnerabilities were discovered in the Linux kernel used in the linux-gke package affecting numerous subsystems including various architectures, device drivers, filesystems, and networking components. These flaws could potentially allow an attacker to compromise the system. A security update has been released to address these issues, requiring a system reboot and recompilation of third-party kernel modules due to an ABI change.
Multiple security vulnerabilities have been identified in CPython, specifically affecting Python versions 3.12 and 3.15 as distributed by Red Hat. The issues include a use-after-free vulnerability in server-side SSLContext when the sni_callback switches contexts (CVE-2026-19445) and a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553). These vulnerabilities impact Red Hat Hardened Images and Red Hat Enterprise Linux 8 distributions. Security updates addressing these issues have been released by Red Hat.
iperf3 version 3.21 contains a remote, unauthenticated heap use-after-free vulnerability in the server's per-test watchdog function. The issue arises because the server_timer_proc() function frees streams without properly cancelling or joining their worker threads, leading to a use-after-free condition when a blocked worker thread dereferences a freed iperf_stream. This vulnerability is fixed in version 3.22.
A vulnerability in Apache MINA SSHD's sshd-ldap component versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 allows bypassing authentication checks due to a missing validation in LdapPasswordAuthenticator. This affects SSH servers using sshd-ldap with LdapPasswordAuthenticator configured for password authentication. The core sshd password authentication is not impacted. Upgrading to versions 2.20.0 or 3.0.0-M6 resolves the issue.
Multiple high-impact security vulnerabilities have been fixed in Mozilla Firefox ESR, including use-after-free bugs, sandbox escapes, information disclosure, and privilege escalation issues across various components such as DOM, JavaScript WebAssembly, Graphics, and Audio/Video. These vulnerabilities affect Firefox ESR versions prior to 153.4 and have been addressed in the Firefox ESR 153.4 release.
A security vulnerability (CVE-2026-13732) in the GNU Debugger (gdb) on Red Hat Enterprise Linux 8 allows an out-of-bounds write via a crafted ELF binary due to a flaw in the STABS debug format parser. This flaw could enable code execution. Red Hat has released an important security update addressing this issue for multiple architectures including x86_64, IBM z Systems, Power little endian, and ARM 64. The update is available and should be applied to affected systems.
Multiple security vulnerabilities have been identified in the Skia component used by the chromium-browser (Google Chrome) as part of the WebKitGTK port. These include use-after-free, cross-origin data disclosure, information disclosure, integer overflow, out of bounds read, memory corruption, and improper input validation issues. These vulnerabilities affect Red Hat Enterprise Linux 9 and related distributions. A security update for webkit2gtk3 has been released by Red Hat to address these issues.
Multiple security vulnerabilities were discovered in OpenSSL, affecting various Ubuntu LTS releases. These include issues with certificate revocation list handling, QUIC protocol implementation, scalar multiplication on elliptic curves, SSL context switching, and DTLS handshake processing. The vulnerabilities could lead to denial of service through excessive memory consumption or out-of-bounds reads, as well as timing side-channel attacks potentially exposing sensitive information. Fixes have been released for affected Ubuntu versions, and users are advised to update and reboot their systems.
Python virtualenv versions prior to 21.7.13 contain a vulnerability in the generated activation scripts (bash, zsh, and fish). These scripts improperly double-quote values already escaped by shlex.quote, which can lead to shell metacharacters being interpreted as commands when the activation script is sourced. This allows an attacker to execute arbitrary code with the user's privileges. The issue is resolved in version 21.7.13.
ZoneMinder version 1.37.0 contains a path traversal vulnerability in the files view that allows authenticated users with Events view permission to read arbitrary files. The vulnerability arises because the path parameter is not properly validated before being passed to the output_file function, enabling access to sensitive files such as configuration files containing database credentials. This issue is fixed in version 1.38.0.
A heap buffer overflow vulnerability exists in the cjose library used in Red Hat Enterprise Linux 9.2. This flaw occurs during AES Key Wrap decryption and can lead to denial of service and potential data manipulation. An important security update addressing this issue is available for affected Red Hat Enterprise Linux 9.2 variants.