Apache TomEE's Jakarta Security LDAP identity store improperly accepts empty passwords as valid if the directory server allows unauthenticated binds, which some directory servers do by default. This flaw allows a remote attacker to authenticate as any existing user without knowing their password. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
CVE-2026-111262 is an LDAP Injection vulnerability in the Jakarta Security LDAP identity store component of Apache TomEE. It occurs because special characters in the caller name are not neutralized before being used in LDAP directory queries. This flaw allows a remote unauthenticated attacker to manipulate LDAP queries to enumerate accounts, infer directory attribute values, or affect login validation. The issue affects only applications using the LDAP identity store. Upgrading to Apache TomEE versions 10.3.0 or 11.0.0-M2 resolves the vulnerability.
Apache TomEE versions from 1.5.0 through 4.0.0 and certain milestone releases up to 10.3.0 and 11.0.0-M2 have a missing authentication enforcement issue for EJB JAX-WS endpoints when published within existing web applications. This allows remote unauthenticated attackers to invoke web service operations unless additional application-level security constraints are applied. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
CVE-2026-111264 is an authentication bypass vulnerability in Apache TomEE affecting EJB JAX-WS endpoints. The security constraint for these endpoints only protects certain HTTP methods, allowing a remote unauthenticated attacker to bypass authentication by using an alternate HTTP method. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
The CISO Forum Virtual Summit 2026 is a two-day online event designed for senior cybersecurity leaders to discuss and learn about risk management and defense strategies in modern enterprises. The summit focuses heavily on the integration of artificial intelligence in cybersecurity, addressing AI-driven threat landscapes, AI governance, third-party risk management, and team resilience. Sessions cover topics such as securing generative AI, managing cyber risk at machine speed, AI accountability frameworks, and supply chain defense in the AI era. The event aims to provide actionable strategies rather than theoretical discussions, with expert speakers sharing practical frameworks and case studies.
WhiteMatter is a cybersecurity startup that provides a platform to secure and govern AI agents operating within an organization's environment. The platform deploys dedicated guardian agents for each AI agent, enabling continuous policy-driven control and visibility across endpoints, cloud, SaaS, and code. The company recently raised $20 million in Series A funding to accelerate development and expand its market presence. There is no indication of a security vulnerability or threat associated with this announcement.
Apache TomEE versions prior to 10.3.0 and 11.0.0-M2 contain a vulnerability where internal system EJBs used for remote deployment and configuration do not enforce administrative role checks when running with the default profile. This allows a remote unauthenticated attacker who can access the remote EJB endpoint to deploy arbitrary applications and execute code. Only installations with enabled system applications and remote EJB endpoints are affected. Upgrading to versions 10.3.0 or 11.0.0-M2 resolves the issue.
Apache TomEE versions prior to 10.3.0 and 11.0.0-M2 generate stateful session bean identifiers using a non-cryptographically secure random source. This flaw allows a remote attacker with a valid identifier to predict other clients' session identifiers and access or modify their session state. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
Apache TomEE contains a path traversal vulnerability in its stateful session bean passivation mechanism. The on-disk file name used for session state is derived from a client-supplied identifier without proper validation, allowing a remote attacker with access to the remote EJB service to read or write files outside the intended passivation directory. This issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
Apache TomEE's bundled JAAS login modules have a vulnerability where they leak information about username existence and perform credential comparisons in a non-constant-time manner. This allows a remote unauthenticated attacker to enumerate valid accounts and potentially infer credential material through timing analysis. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
SAP released 42 new and updated security advisories in November 2026, including nine critical vulnerabilities affecting components such as NetWeaver, Web Dispatcher, and Gateway. Notably, the ICM2SHELL vulnerability allows unauthenticated remote code execution with <sid>adm privileges via crafted WebSocket messages, leading to memory corruption or process crashes. The ProxyGate vulnerability enables unauthenticated attackers to bypass access controls and execute OS commands with high privileges. These kernel-level flaws affect multiple SAP releases, including out-of-maintenance versions, and impact various SAP system types. Additional critical issues include missing authentication bugs that could lead to full system compromise. SAP has published patches addressing these vulnerabilities.
Docker Desktop versions prior to 4.94.0 could log the user's Docker Hub access token in cleartext within application logs and diagnostics bundles. This token, a JWT, was exposed because IPC payloads that were bare JSON strings or arrays were not redacted before logging. An attacker with read access to these logs could steal the token and impersonate the user on Docker Hub while the token remains valid. Version 4.94.0 of Docker Desktop introduced redaction of these sensitive payloads. However, logs created by earlier versions remain unaltered and may still contain exposed tokens after upgrading.
Eclipse Kura versions 5.0.0 through 5.6.2 contain a vulnerability in the Wire Graph update functionality of the Web UI and the Wire Service REST API v1. The flaw allows an authenticated user with limited wires management permissions to modify configurations of components outside the Wire Graph, including security-relevant components, by relying on untrusted factory identifiers in requests. This can lead to escalation to full administrative privileges and potential device disruption. The issue requires at least one Driver installed on the device and is fixed in version 5.6.3.
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.
Eclipse Kura versions 0.7.0 through 5.6.2 have a vulnerability where deployment packages and REST upload requests can be downloaded or uploaded without any size limit. This can lead to exhaustion of local storage or RAM-backed temporary directories, causing denial of service conditions such as failed configuration persistence, failed logging, and potential crashes of the framework or other services. The vulnerability arises from the lack of limits on the size of data received from remote or local sources.
CVE-2026-120399 is a vulnerability in Red Hat Edge Manager 1's flightctl component where a TLS handshake is performed synchronously without a deadline in the HTTP server's connection-context callback. This allows a network-reachable unauthenticated client to stall the handshake process, causing the affected listener to stop accepting new connections. Existing connections remain unaffected. The issue results in a denial of service (DoS) by resource exhaustion.
CopperDragon is a digital quartermaster entity linked to multiple China-nexus threat actors using the Sparrow malware framework to target telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe. The threat operates through three distinct clusters—SilentDelivery, OceanGate, and DarkWire—each employing different toolsets and initial access techniques, including selective watering-hole attacks and compromising internet-facing infrastructure. The malware framework includes Windows and Linux variants with passive backdoor capabilities and connections to other backdoors like Melofee. SilentDelivery notably uses Trojanized MSI installers disguised as certificate repair utilities delivered via compromised websites in government, shipping, and IT sectors. The campaigns have been ongoing for over a year, targeting high-profile organizations with sophisticated multi-stage infection chains.
Red Hat has released a security advisory for the unbound DNS resolver addressing three vulnerabilities: a DNS cache poisoning issue via promiscuous additional section RRSet acceptance (CVE-2026-42960), a DNSSEC validator NSEC3 hash calculation limit bypass leading to denial of service (CVE-2026-42923), and a denial of service caused by locking inconsistency during RPZ XFR reload (CVE-2026-44608). These issues affect Red Hat Enterprise Linux 10 and related products. The update includes bug fixes and enhancements, updating unbound to version 1.26.1-2.el10_3. The vulnerabilities have been rated with moderate security impact by Red Hat.
CVE-2026-124950 is a same-origin policy bypass vulnerability in the CSS Parsing and Computation component of Mozilla Firefox. This security flaw allows bypassing the same-origin policy, which is a critical browser security mechanism. The vulnerability was fixed in Firefox version 160. The impact of this vulnerability is considered high. No public exploit code or in-the-wild exploitation has been reported.