CVE-2026-119344 is a critical origin validation error in the Cocos AI confidential computing system versions 0.8.2 and earlier. The vulnerability allows a remote attacker controlling another trusted platform to substitute valid attestation Evidence, causing authorization of an incorrect platform. This flaw arises because the system accepts attestation Evidence without binding it to a unique platform owner or enforcing revocation. The issue is addressed in version 0.9.0, but cannot be fully mitigated by source code changes alone due to the underlying confidential computing threat model.
Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:
-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.
-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.
-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
Multiple critical security vulnerabilities have been identified and fixed in the ANGLE component used by Chromium-based browsers within the webkit2gtk3 package on Red Hat Enterprise Linux 9.4. These include arbitrary code execution, information disclosure, use-after-free, buffer overflow, improper input validation, and uninitialized resource vulnerabilities. The update addresses these issues and also fixes a regression affecting Eclipse IDE WebKit-based views on CentOS Stream 9.
Apache Juneau versions through 9.2.0 have an Insufficiently Protected Credentials vulnerability in the RestClient component. The RestClient followed HTTP redirects while retaining credential headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key from the original request. This behavior could expose sensitive credentials to unintended hosts or downgrade from HTTPS to HTTP, risking credential leakage. The issue is fixed in version 9.2.1 by changing the handling of redirects and credential headers.
Apache Juneau versions through 9.2.0 have a vulnerability where sensitive request headers are logged in cleartext when a server error occurs. This includes headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key. The issue is fixed in version 9.2.1.
Apache Juneau versions through 9.2.0 have a vulnerability where error messages expose sensitive internal exception details to remote clients. This occurs because the REST server includes the internal exception class and message in a "Thrown" response header and may include exception messages in the error body, even when stack-trace rendering is disabled. This information disclosure reveals implementation details that could aid attackers. The issue is fixed in version 9.2.1.
Apache Juneau versions through 9.2.0 have a Cross-Site Request Forgery (CSRF) vulnerability. The REST server accepts a 'content' query parameter that replaces the request body and is enabled by default on all HTTP methods, including GET. This allows an attacker to craft a cross-site link that delivers an attacker-chosen request body without triggering CORS preflight checks, bypassing protections that rely on HTTP method or content type instead of anti-CSRF tokens. The issue is fixed in version 9.2.1. Users can also mitigate by disabling the content parameter if it is not used.
Apache Juneau versions through 9.2.0 contain a vulnerability where parsing a value into a java.lang.Class property causes the named class to be loaded with initialization, triggering its static initializer. This improper control of dynamically-loaded code can lead to unintended code execution depending on the classes present in the deployment. The issue is fixed in version 9.2.1.
CVE-2026-121489 is a critical path traversal vulnerability in Apache Juneau affecting versions prior to 9.2.1. The DirectoryResource microservice fails to restrict request paths to its configured root directory, allowing clients to read, write, or delete files outside the intended directory when certain resource settings are enabled. This flaw is fixed in version 9.2.1.
CVE-2026-96677 is a critical cross-site scripting (XSS) vulnerability in Apache Juneau affecting versions prior to 9.2.1. The issue arises because HTML document serialization does not encode variable substitutions in page chrome elements such as headers and navigation bars. Applications that include request-derived variables in these areas without encoding them are vulnerable to XSS attacks. The default chrome does not use request variables, so only customized applications are affected. The vulnerability is fixed in Apache Juneau version 9.2.1.
CVE-2026-73117 is a critical HTTP Response Splitting vulnerability in Apache Juneau through version 9.2.0. The issue arises because response header values and redirect targets passed to the servlet container are not properly sanitized, allowing remote attackers to inject malicious header lines or redirect users to arbitrary external sites. The vulnerability depends on application code that uses request data to set headers or redirects. Apache Juneau version 9.2.1 addresses this by sanitizing header values by default and introducing a safer redirect method.