A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seven countries, successfully compromising organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Activities included source code theft, credential collection, SSH persistence, and lateral movement, with one case escalating from a vulnerable Gitea server to root access across a three-node Proxmox cluster. An exposed staging server revealed targeting taxonomies using Simplified Chinese labels covering defense, elections, energy, aerospace, telecommunications, and government sectors. The campaign deployed JITTERLY, a C++ Linux implant with 30+ post-exploitation commands, embedding SIXZUT, a previously undocumented LD_PRELOAD rootkit capable of hiding files, processes, and network connections while protecting the implant from termination.
An improper input validation vulnerability exists in Apache Tomcat due to an incomplete fix for CVE-2026-32990. This vulnerability affects HTTP/2 no-authority handling, allowing bypass of strict Server Name Indication (SNI) validation. It impacts Apache Tomcat versions 9.0.115 through 9.0.120, 10.1.53 through 10.1.57, and 11.0.20 through 11.0.24. The issue is resolved in versions 9.0.121, 10.1.58, and 11.0.25.
CVE-2026-65182 is a critical improper access control vulnerability in Apache Tomcat that allows security constraint bypass when a longer path constraint is specified before a more restrictive constraint for a shorter sub-path. This affects multiple versions of Apache Tomcat from 7.0.0 through 11.0.24. The vulnerability can lead to unauthorized access due to incorrect authorization checks. Fixed versions include 11.0.25, 10.1.58, and 9.0.121.
Apache Tomcat contains an uncontrolled resource consumption vulnerability due to an allocation leak in HTTP/2 backlog tracking when a stream is reset. This vulnerability affects multiple versions across the 8.5.x, 9.0.x, 10.1.x, and 11.0.x branches, as well as some older 6.x and 7.x versions. The issue can lead to denial of service (DoS) conditions by exhausting server resources. Fixed versions are available, and users are advised to upgrade to mitigate the issue.
Apache Tomcat's DIGEST authentication mechanism contains a vulnerability that allows a limited replay attack. An attacker can replay a DIGEST authenticated request once if it uses a nonceCount at the upper boundary of the replay window before the windowSize requests have been made. This affects multiple versions of Apache Tomcat, including some end-of-life versions. The issue is fixed in Apache Tomcat versions 11.0.25, 10.1.58, and 9.0.121.
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat affects Unix domain socket permission setting, allowing unauthorized local users to access the socket. This issue impacts Apache Tomcat versions 9.0.42 through 9.0.120, 10.1.0 through 10.1.57, and 11.0.0 through 11.0.24. Fixed versions are 9.0.121, 10.1.58, and 11.0.25. The vulnerability has a CVSS score of 8.1, indicating a high severity level. No known exploits are reported in the wild. This vulnerability does not affect cloud services and is not known to target any specific countries.
Apache Tomcat has an Insufficient Session Expiration vulnerability (CVE-2026-73180) where authenticated WebSocket sessions may persist after the associated HTTP session ends if the session ID changes. This affects multiple versions across Tomcat 7, 8.5, 9, 10.1, and 11 branches. The vulnerability is fixed in versions 11.0.25, 10.1.58, and 9.0.121. Users should upgrade to these or later versions to mitigate the issue.
CVE-2026-68569 is an improper authentication vulnerability in Apache Tomcat affecting multiple versions from 7.0.0 through 11.0.24. The flaw allows authentication of users who do not exist in the DataSourceRealm under certain authentication methods such as CLIENT-CERT and SPNEGO. This could lead to unauthorized access. The issue has been fixed in Apache Tomcat versions 11.0.25, 10.1.58, and 9.0.121.
CVE-2026-68525 is a critical incorrect authorization vulnerability in Apache Tomcat's FORM authentication process. It allows bypassing a security constraint that restricts user access to a resource's POST method but not the GET method. This affects multiple versions of Apache Tomcat from 7.0.0 through 11.0.24, including some end-of-life versions. The issue is fixed in versions 11.0.25, 10.1.58, and 9.0.121.
CVE-2026-66422 is an improper authorization vulnerability in Apache Tomcat caused by incorrect use of security-role-ref definitions as role aliases within the Realm, in addition to their correct use with Request.isUserInRole(). This affects multiple versions of Apache Tomcat, including 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.25 through 9.0.120, and some older EOL versions. The issue allows unauthorized actions due to flawed role authorization checks. Upgrading to versions 11.0.25, 10.1.58, or 9.0.121 resolves the vulnerability.
An off-by-one error vulnerability (CWE-193) in Apache Tomcat's rewrite valve processing causes the rewrite to restart at the second rule instead of the first. This affects multiple versions of Apache Tomcat from 8.5.0 through 11.0.24. The issue has been fixed in versions 11.0.25, 10.1.58, and 9.0.121. The vulnerability has a CVSS score of 7.5, indicating high severity, and impacts availability without affecting confidentiality or integrity.
CVE-2026-15310 is a low-severity vulnerability in CPython where decompressing crafted zip files using bzip, LZMA, or Zstandard compression can lead to uncontrolled resource consumption. An attacker can specify a size that causes Python to pre-allocate excessive memory, potentially exhausting system memory. This issue affects multiple Python versions prior to their respective fixed releases.
CVE-2026-78581 is an authorization bypass vulnerability in Elastic Kibana version 8.0.0. It allows an authenticated user to access or modify AI Assistant conversations belonging to other users by referencing another user's conversation identifier. Exploitation requires knowledge of a hard-to-guess identifier. The vulnerability has a medium severity with a CVSS score of 4.2.
A vulnerability in Keycloak's WebAuthn registration component allows bypassing the configured attestation policy by submitting an attestation object with fmt: "none". This occurs even when the realm requires direct attestation, potentially enabling registration of untrusted or forged authenticators. The issue affects Keycloak versions prior to 26.4.4. A security update is available from Red Hat to address this flaw.
A vulnerability in the legacy client-initiated account-linking endpoint of Keycloak allows a malicious OpenID Connect (OIDC) client to predict the hash protecting the account-linking process. This flaw enables an attacker to forge a valid linking URL after tricking a user into authenticating, resulting in full account takeover by linking the victim's account to the attacker's external identity. The issue affects Keycloak versions prior to 26.7.2. Official patches are available from Red Hat for the affected versions.
CVE-2026-5006 is an authorization bypass vulnerability in HashiCorp Vault and Vault Enterprise. An authenticated attacker can manipulate an identity value in a templated policy path, including slash characters, to gain unintended access to Vault paths. This vulnerability was fixed in Vault Community Edition 2.0.4 and Vault Enterprise versions 2.0.4, 1.21.9, 1.20.14, and 1.19.20.
Mastodon versions prior to 4.4.19 and from 4.5.0 up to but not including 4.5.12 contain a vulnerability where SSL/TLS certificate verification can be globally disabled for requests made by puma web processes when LDAP authentication is configured with LDAP_TLS_NO_VERIFY=true. This occurs due to mutation of OpenSSL::SSL::SSLContext::DEFAULT_PARAMS in the LDAP authentication code. The issue does not affect sidekiq background jobs. The vulnerability is fixed in versions 4.4.19 and 4.5.12.
Discourse versions prior to 2026.1.6, 2026.5.2, and 2026.6.1 could leak shared-draft topic titles and post excerpts through group post serialization endpoints to users who can view group activity but are not authorized to see drafts. This results in information disclosure of unpublished draft content. The issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Discourse versions prior to 2026.1.6, 2026.5.2, and 2026.6.1 contain a vulnerability where an unauthenticated attacker can inject arbitrary HTML via crafted color_scheme_id or dark_scheme_id cookies. This injection bypasses the platform's nonce-based Content Security Policy, enabling arbitrary JavaScript execution in visitors' browsers. The issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 leak hidden or unviewable first-post content in the publicly accessible Q&A schema JSON-LD data. This exposure allows unauthenticated visitors and search engine crawlers to access content intended to be hidden. The issue has been fixed in the specified versions.
