A security vulnerability (CVE-2026-19953) exists in the perl-URI module used in Red Hat Enterprise Linux 10. The flaw involves a security bypass caused by incorrect hostname encoding due to missing Unicode normalization. This issue affects the URI class implementation for Perl, which handles Uniform Resource Identifier references. Red Hat has issued a security update to address this vulnerability.
IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:
* Certificate Authority (CA)
* Key Recovery Authority (KRA)
* Online Certificate Status Protocol (OCSP) Manager
* Token Key Service (TKS)
* Token Processing Service (TPS)
* Automatic Certificate Management Environment (ACME) Responder
* Enrollment over Secure Transport (EST) Responder
Security Fix(es):
* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)
* com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Stored XSS.This issue affects Event post: from n/a through 6.1.2.
CVE-2026-125444 is a missing authorization vulnerability in King Addons for Elementor that affects versions prior to 51.1.90. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity score of 5.3 and impacts confidentiality but not integrity or availability. A fix is available in version 51.1.90.
CVE-2026-124271 is a missing authorization vulnerability in the DEV Institute Restrict User Access – Membership Plugin with Force. The flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access. This affects versions from initial releases up to 2.8.3. The issue is addressed in version 2.8.4.
Guava is a suite of core and expanded libraries that include utility classes, Google’s collections, io classes, and much much more. This project is a complete packaging of all the Guava libraries into a single jar. Individual portions of Guava can be used by downloading the appropriate module and its dependencies.
Security Fix(es):
* com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A heap buffer overflow vulnerability exists in the gstreamer1-plugins-base package due to unvalidated GstVideoMeta plane extents in the functions gst_video_frame_map_id and video_meta_deserialize. This issue affects Red Hat Enterprise Linux 10 across multiple architectures. A security update addressing this vulnerability has been released by Red Hat.
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
* pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
* pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
* pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)
* pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
* pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security advisory for Grafana addressing three vulnerabilities: an Azure Monitor data source could leak its Azure access token (CVE-2026-88967), a denial of service vulnerability in the klauspost/compress zstd library via crafted compressed input (CVE-2026-116591), and an information disclosure issue via a legacy schema switch in contact points (CVE-2026-100105). These issues affect Red Hat Enterprise Linux 10 across multiple architectures. The update to Grafana version 12.4.3-3.el10_3.6 resolves these vulnerabilities.
A denial of service vulnerability (CVE-2026-19248) exists in the XML parsing component of the Qt6 QtBase toolkit. This vulnerability affects Red Hat Enterprise Linux 10 packages of qt6-qtbase. The issue could cause applications using this library to become unresponsive or crash when processing crafted XML data. Red Hat has issued a security advisory and released updated packages to address this moderate severity flaw.
The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Reset Database plugin for WordPress, versions up to and including 1.1.3, contains a privilege escalation vulnerability. The flaw arises from the process_reset() function being triggered without proper capability checks, combined with a nonce that is computed but unused, and a gating condition that allows the reset process if no administrator named 'admin' exists. Additionally, the identity verification checks the attacker's own password rather than an administrator's, enabling authenticated users with subscriber-level access or higher to reset the database, become the sole administrator, and delete the uploads directory.
The 6Storage Rentals WordPress plugin up to version 2.31.0 contains an authentication bypass vulnerability allowing users with Subscriber-level access or higher to authenticate as any existing WordPress user, including administrators. This occurs due to missing capability checks and nonce verification in AJAX handlers that allow attacker-controlled data to influence authentication state, leading to full site compromise. The issue is a partial fix of a prior vulnerability and remains exploitable.
Multiple security vulnerabilities have been identified in the cockpit-files component of Red Hat Enterprise Linux 10. These include arbitrary file ownership and permission modifications via symlink race conditions and privileged paste operations. The issues allow local attackers to hijack file ownership through symlink races. Red Hat has released updates to address these vulnerabilities.
Bay is a newly launched company that provides a control plane for enterprise AI agents to manage and restrict their actions. Founded by ex-IDF Unit 8200 officers, Bay offers a solution that inventories AI agents and evaluates their actions in real-time to prevent unintended or risky behaviors. The system uses AI-driven policies to enforce controls and ensure safe operation of AI agents within organizations.
Multiple security vulnerabilities have been identified in the libxml2 library used in Red Hat Enterprise Linux 10. These include arbitrary code execution via buffer overflows, data integrity issues from integer overflow, heap-based buffer overflow, information disclosure, SSRF, denial of service, and double-free/use-after-free in Python bindings. Red Hat has issued an important security update addressing these issues.
Multiple security vulnerabilities have been identified in the Expat XML parsing library used by Red Hat Enterprise Linux 10. These include denial of service via quadratic complexity in attribute processing, XML injection through malformed UTF-16 input, denial of service via integer overflow in memory reallocation, and information disclosure due to heap buffer over-read. Red Hat has issued an important security advisory with updates addressing these issues in Expat version 2.7.3-2.el10_3.4 for various architectures.
Multiple security vulnerabilities affecting the Grafana plugin for Performance Co-Pilot in Red Hat Enterprise Linux 10 have been addressed. These include denial of service issues in various Go libraries (encoding/asn1, net/url, net/http, crypto/tls, net/textproto), a cross-site scripting vulnerability in html/template, and a man-in-the-middle attack vector via untrusted intermediate certificates in crypto/x509. The update also includes bug fixes and enhancements for the vLLM AI dashboard. The vulnerabilities are rated as important by Red Hat Product Security.
Multiple security vulnerabilities have been identified in OpenSSL, including several denial of service (DoS) issues via excessive memory allocation, QUIC protocol weaknesses, and out-of-bounds writes. Additionally, private key recovery is possible through timing side-channel attacks on elliptic curve operations and SM2 scalar multiplication. These vulnerabilities affect OpenSSL as implemented in Red Hat Enterprise Linux 10. The update also addresses bugs related to FIPS mode and thread initialization.
A security vulnerability in NetworkManager allows bypassing the private_user restriction for 802.1x ca-path and phase2-ca-path, which can lead to WPA-Enterprise server validation bypass. This issue is an incomplete fix for a previous vulnerability (CVE-2025-9615) and affects Red Hat Enterprise Linux 10 and related products. Red Hat has released an update to address this vulnerability.