CVE-2026-102895 is an authentication bypass vulnerability in GPUStack, an open-source software managing GPU clusters for AI workloads. The flaw arises because GPUStack trusts the 'X-Gpustack-Real-IP' header to identify request origin. If this header indicates a loopback IP (127.0.0.1), GPUStack bypasses authentication, allowing attackers to spoof this header and gain unauthorized access. This affects all versions prior to 2.2.0, which was released at the end of June 2026. The vulnerability was publicly disclosed at the end of July 2026, with the CVE assigned on November 4, 2026. Exploit attempts have been observed but no confirmed exploitation in the wild is reported.
Two security vulnerabilities were addressed in the Cockpit web-based server administration tool for Red Hat Enterprise Linux 8. One is a local privilege escalation caused by insecure symbolic link handling in the public key addition helper (CVE-2026-91151). The other is a denial of service vulnerability due to unbounded fragmented WebSocket messages (CVE-2026-91150). These issues have been fixed in updated Cockpit packages provided by Red Hat.
A security vulnerability (CVE-2026-13732) in the GNU Debugger (GDB) affects Red Hat Enterprise Linux 8.6. The flaw is an out-of-bounds write in the STABS parser function read_member_functions() triggered by a crafted ELF file. Red Hat has released an important security update to address this issue in GDB packages for affected versions.
Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS.
This issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.
The Masterstudy - Education WordPress Theme contains a missing authorization vulnerability in all versions up to 4.8.151. This flaw allows authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator by exploiting an AJAX action lacking proper authorization and nonce validation. The vulnerability enables attackers to set a transient token and use an auto-login flow to gain administrator session cookies.
VibeBP plugin for WordPress versions up to 1.9.9.8.1 contains a privilege escalation vulnerability. Authenticated users with Subscriber-level access or higher can exploit the set_email_notification_settings() function to update their own 'wp_capabilities' user meta, granting themselves administrator privileges.
WP Table Builder – Drag & Drop Table Builder plugin for WordPress versions up to 2.1.7 is vulnerable to stored Cross-Site Scripting (XSS) via the 'url' parameter. Authenticated users with contributor-level permissions or higher can inject malicious scripts that execute when other users access the affected pages. Lower-privileged users require explicit permission from an administrator to exploit this vulnerability. This flaw arises from insufficient input sanitization and output escaping.
The CourseCure Courses WordPress plugin up to version 1.5.1 contains a privilege escalation vulnerability due to missing authorization checks in the ajax_save_settings() function. Authenticated users with subscriber-level access or higher can exploit this flaw by modifying WordPress options to set the default role to administrator and enable user registration, allowing them to create new administrator accounts.
CVE-2026-114369 is a resource exhaustion vulnerability in the Qt Framework affecting the QWebSocket and QWebSocketServer classes within the Qt WebSockets module. It involves inefficient algorithmic complexity that could be exploited to degrade service availability. The vulnerability affects Qt Framework versions from 5.15.0 through 6.8.9 and 6.9.0 through 6.12.0. The CVSS 4.0 base score is 2.7, indicating a low severity issue. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.
Notion experienced a data breach due to two hacks of Fireworks AI, a cloud platform used by Notion for AI model inference. Attackers accessed chat transcripts from fewer than 1% of Notion workspaces. Most transcripts could not be attributed to specific customers or workspaces. Notion has notified affected customers and recommends rotating any credentials that may have been exposed in the compromised AI chat data.
CVE-2026-124704 is a deserialization of untrusted data vulnerability in Progress Software's Telerik UI for WPF affecting versions from 2026.3.1007 up to but not including 2026.4.1110. This flaw allows an attacker to perform unauthorized actions within the context of the affected application. The vulnerability has a high severity rating with a CVSS score of 7.8. A fix is available in version 2026.4.1110.
A denial of service vulnerability exists in the rsync utility due to crafted checksums during delta transfer. This flaw can cause the rsync process to crash or become unresponsive when processing maliciously crafted data. The issue affects Red Hat Enterprise Linux 10.2 Extended Update Support and related variants. Red Hat has issued a security advisory and released updated packages to address this vulnerability.
CVE-2026-124703 is a code injection vulnerability in Progress Software's Telerik UI for WPF affecting versions from 2026.3.1007 up to but not including 2026.4.1110. This flaw allows an attacker to execute unauthorized code within the context of the affected application due to improper control of code generation. The vulnerability has a high severity rating with a CVSS score of 7.8. A fix is available in version 2026.4.1110.
CVE-2026-126644 is a link-following flaw in the authorized_key module of the ansible.posix collection used in Red Hat Enterprise Linux 10. It allows an unprivileged local user to replace their ~/.ssh directory with a symlink to a directory they do not own. When an operator runs the authorized_key task as root, the module writes files through the symlink, potentially overwriting files in attacker-controlled directories. This flaw does not allow privilege escalation but can cause integrity and availability impacts by overwriting files such as those in /etc/apt/apt.conf.d/.
Multiple security vulnerabilities have been identified in Red Hat Enterprise Linux's OpenSSH implementation, including local man-in-the-middle attacks, denial of service, security bypasses, information disclosure, and command injection. These issues affect both the OpenSSH client and server components. Red Hat has released an important security update addressing these flaws in OpenSSH for Red Hat Enterprise Linux 8.6.
CVE-2026-126643 is a cleartext storage vulnerability in the Red Hat Ansible Automation Platform 2's AAP Gateway Operator. The operator copies a sensitive resource-server secret from a Kubernetes Secret into the AutomationController custom resource in plaintext. This exposure breaks the intended RBAC separation, allowing any user with read access to the AutomationController resource but not the Secret to obtain the secret. The secret may also be exposed in Kubernetes API storage, GitOps histories, manifests, support bundles, and audit data. Disclosure of this secret could allow impersonation of a trusted Controller service and access to privileged APIs.
CVE-2026-126641 is a vulnerability in Red Hat Ansible Automation Platform 2 involving host key verification when trust-on-first-use is enabled. Specifically, if a host key changes for a host already in known_hosts, the new key is accepted without warning, allowing a man-in-the-middle attacker to impersonate the host and potentially capture credentials. Default configurations with host key checking enabled and trust-on-first-use disabled are not affected. Exploitation requires a non-default configuration and an attacker positioned to intercept connections.
A deserialization of untrusted data vulnerability (CWE-502) exists in Progress Software's Telerik UI for WinForms versions from 2026.3.1007 up to but not including 2026.4.1111. This flaw allows an attacker to perform unauthorized actions within the context of the affected application. The vulnerability has a high severity with a CVSS score of 7.8. A fix is available in version 2026.4.1111.