CVE-2026-110901 is an authorization bypass vulnerability in WPMU DEV SmartCrawl SEO plugin versions before 3.17.1. It arises from incorrectly configured access control security levels that allow an attacker with limited privileges to exploit a user-controlled key to bypass authorization checks. The vulnerability has a medium severity with a CVSS score of 5.4.
The WP User Avatar / ProfilePress plugin for WordPress (versions up to and including 4.17.5) contains a vulnerability that allows authenticated users with Subscriber-level access or higher to inject and execute arbitrary shortcodes via crafted comments. This occurs because the plugin processes comment excerpts with insufficient shortcode neutralization, enabling execution of any shortcode present in active plugins or themes when a visitor views the affected profile's Comments tab. The vulnerability can lead to limited confidentiality and integrity impacts by exposing capability-gated shortcodes and injecting raw HTML into publicly viewable pages.
The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.
The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-111210 is a server-side request forgery (SSRF) vulnerability in bitcoinj versions 0.1 through 0.17. The flaw exists in the Payment Request Handler component, specifically in the url.openConnection function of PaymentSession.java. Manipulating the pki_type argument can trigger SSRF, allowing an attacker to make unauthorized requests from the server. The vulnerability can be exploited remotely. The issue was reported early to the project, but no response or fix has been provided yet. The CVSS 4.0 score rates this vulnerability as medium severity (6.9).
CVE-2026-92777 is a medium severity vulnerability in Lenovo Idea Tab Pro (TB373FU) tablets. It involves the use of a default cryptographic key that could allow a user with physical access to an unlocked device to bypass protections and execute arbitrary code. The vulnerability affects multiple firmware versions prior to various 17.x.x.xxx releases. There are no known exploits in the wild and no official patch information provided.
CVE-2026-89057 is a high-severity authentication bypass vulnerability affecting Lenovo Idea Tab Pro (TB373FU) tablets. It allows a user with physical access to bypass authentication and gain unauthorized access to the device. The vulnerability is identified as CWE-288, involving authentication bypass via an alternate path or channel. Multiple firmware versions prior to 17.5.10.362 are affected. No vendor patch or remediation details are provided in the available data.
An authenticated user in @backstage/backend-defaults versions prior to 0.17.8 could invoke backend actions that were intended to be excluded by an operator's action configuration. Although existing action permissions and downstream authorization checks remain in place, this improper access control could lead to unauthorized action invocation. The issue is patched in version 0.17.8. Until upgrading, it is recommended to restrict access to action invocation endpoints to trusted service callers.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.17.59. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:77552
Security Fix(es):
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat OpenShift Container Platform 4.17.59 includes security updates addressing three kernel vulnerabilities: a peer transport count overflow in SCTP (CVE-2026-74469), improper validation of routing header segments_left in AH6 (CVE-2026-80844), and an issue with bound receive headroom in the tun network driver (CVE-2026-81000). These fixes are part of a bug fix and security update for on-premise or private cloud deployments. Users of OpenShift Container Platform 4.17 are advised to upgrade to the updated packages and container images when available.
Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
FIXED BUGS:
==========
DFBUGS-9380: [Backport to odf-4.17.z] Backport CA related fixes for NooBaa
DFBUGS-7336: [Backport to odf-4.17.z] [5.20] Update nodejs from v22.11.0 to v24.13.0
DFBUGS-7106: [Backport to 4.17.z] CLONE - ODF Console is breaking
DFBUGS-7065: RHODF 4.17.28 release
DFBUGS-6744: Backport to odf-4.17.z ODF 4.16.21- noobaa-endpoint crashes with Exit Code 1 due to unhandled AbortError from @azure/storage-blob
CVE-2026-18140 is a denial of service vulnerability in the aws-smithy-json runtime used by smithy-rs generated servers, including Red Hat Trusted Artifact Signer and components in Red Hat Enterprise Linux. An unauthenticated remote attacker can send a crafted HTTP request with deeply nested JSON to trigger uncontrolled recursion, causing stack exhaustion and process abort. This results in service disruption and unavailability. The vulnerability affects Red Hat Trusted Artifact Signer Operator used with OpenShift Container Platform versions 4.17 through 5.0. No fix is currently available, and mitigation involves restricting network access to trusted sources to prevent exposure to untrusted networks.
Sparx Systems Enterprise Architect version 17.1 is affected by an XML External Entity (XXE) injection vulnerability in its XSLT Debugger feature. This flaw allows processing of external entities from crafted XML files containing a DOCTYPE with external DTD references, enabling an attacker to read arbitrary files on the victim's filesystem. The vulnerability has a high severity with a CVSS 4.0 score of 8.2. Attempts to contact the vendor for remediation information were unsuccessful, and no patch information is currently available.
Law enforcement authorities from 17 countries in Latin America and Europe arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) via online messaging groups. The operation, named International Effort Confluencia, involved multiple coordinated actions between March and September 2026. Investigators executed 127 search warrants, rescued a child victim, and seized large quantities of abusive material. The operation highlights the use of messaging platforms for grooming, abuse coordination, and illegal content distribution. Previous related operations have also targeted CSAM distribution networks globally.