A vulnerability in GNU patch allows an attacker to create files arbitrarily outside the intended working directory by using specially crafted patch files. This occurs due to missing validation of absolute file paths during automatic patch reversal, enabling file creation with the permissions of the executing user. The flaw affects multiple specific versions of the patch utility. No official fix or mitigation meeting Red Hat's criteria is currently available.
Bytebase versions before 3.16.0 have an authorization bypass vulnerability in several API endpoints that handle task run data. Authenticated users with permissions on one project can exploit this flaw by supplying task or task run UIDs from other projects, allowing unauthorized access to execution logs, database session details, and rollback SQL of those projects. This vulnerability is fixed in version 3.16.0.
Bytebase versions prior to 3.16.0 contain an authorization bypass vulnerability in the UpdateIssueComment handler. This flaw allows users with low privileges, including Project Viewers, to modify comments in projects they do not have access to by supplying a foreign comment UID. The vulnerability is fixed in version 3.16.0.
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).
count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the serialized number of buckets and number of hash functions in 32-bit arithmetic. A crafted sketch could make it wrap to zero, so that the sketch deserialized with an empty table, and later updates and estimate queries read and wrote outside the heap allocation. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.
This issue affects Apache DataSketches C++: from 4.1.0 before 5.3.0. Only applications that deserialize Count-Min sketches from untrusted sources are affected.
Users are recommended to upgrade to version 5.3.0, which fixes this issue.
Red Hat has released a critical security update for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16. The update addresses multiple vulnerabilities identified by several CVEs, including CVE-2024-38827 and numerous others. Users of OpenShift Jenkins 4.16 are recommended to upgrade to the latest version to mitigate these security issues.
CVE-2026-97328 is a Cross-Site Scripting (XSS) vulnerability in the WebP Express WordPress plugin versions before 0.25.16. The flaw occurs because the plugin does not properly escape values emitted into HTML element attributes by its bundled parser when a non-default image delivery mode is enabled. This allows unauthenticated users to inject malicious scripts that execute in the browsers of users viewing affected pages, including administrators.
The Infility Global WordPress plugin versions before 2.16.25 contain a missing authorization vulnerability in an AJAX action accessible to unauthenticated users. This flaw allows any visitor to overwrite a machine-translation configuration value of a companion plugin without proper authorization or nonce verification.
A vulnerability in Roundcube was fixed that addressed a bug where an alias login was not properly qualified by the IMAP host. This flaw could allow an attacker with low privileges to gain unauthorized access under certain conditions. The issue affects multiple specific versions of Roundcube. The CVSS score is 6.8, indicating a medium severity impact with high confidentiality and integrity impact but no availability impact.
A vulnerability in Roundcube involves the CSS proxy content processing lacking a size limit, potentially leading to denial of service conditions. The issue affects multiple specific versions of Roundcube. The CVSS score is 5.3, indicating a medium severity impact primarily affecting availability. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
A Server-Side Request Forgery (SSRF) vulnerability in Roundcube allows bypass of the is_local_url() filter via NAT64 64:ff9b::/96 addresses. This vulnerability affects multiple specific versions of Roundcube and has a high severity rating with a CVSS score of 7.2. The flaw could allow an attacker to cause the server to make unauthorized requests, potentially leading to information disclosure or other impacts.
A vulnerability in Roundcube allows bypassing remote content blocking via SVG SMIL by attribute. This issue affects multiple specific versions of Roundcube and has a medium severity rating with a CVSS score of 5.3. The vulnerability does not require privileges or user interaction to exploit and impacts confidentiality without affecting integrity or availability.
HAProxy versions before 3.4.6 contain a vulnerability that allows a remote unauthenticated attacker to cause a denial of service. This vulnerability does not impact confidentiality or integrity but can disrupt availability by causing service outages.
HAProxy versions 3.2 before 3.4.6 contain a vulnerability that allows a remote unauthenticated attacker to cause a denial of service (DoS) condition. This flaw does not impact confidentiality or integrity but can disrupt availability by crashing or otherwise incapacitating the service.
A vulnerability in Roundcube allows bypassing remote content blocking via CSS escapes in FuncIRI attributes. This issue affects multiple specific versions of Roundcube and has a medium severity rating with a CVSS score of 5.3. The vulnerability does not require user interaction or privileges and impacts confidentiality by potentially allowing remote content to be loaded despite blocking mechanisms.
A high-severity vulnerability (CVE-2026-114727) in Roundcube involves unsafe handling of attachment content passed to ImageMagick during image resizing. This flaw could lead to high impact on confidentiality, integrity, and availability. Multiple specific versions of Roundcube are affected. The vulnerability has a CVSS score of 8.3, indicating a serious risk. No public exploits are known in the wild. The product is not a cloud service, and no explicit patch information is provided in the input.
A mail header injection vulnerability exists in Roundcube via the From display-name in the Bounce (resend) action. This flaw allows an attacker to inject malicious content into email headers when resending bounced emails. The vulnerability affects multiple specific versions of Roundcube. The CVSS score is 5.8, indicating a medium severity impact primarily on email integrity.
A mail header injection vulnerability exists in Roundcube affecting specific versions. The flaw involves injection via the References, In-Reply-To, Message-ID, and From email header parameters. This vulnerability has a medium severity rating with a CVSS score of 5.0. No known exploits in the wild have been reported. The affected versions are explicitly listed and include multiple specific package versions.
A high-severity vulnerability (CVE-2026-114724) in Roundcube affects multiple specific versions. The flaw involves an object injection primitive in the rcube_session::unserialize() function via session keys prefixed with an exclamation mark (!). This vulnerability can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 7.4, indicating high impact. No public exploits or known exploitation in the wild have been reported. The affected versions are explicitly listed, and the product is not a cloud service.