Critical severity threats

CVE-2026-73116 is a critical vulnerability in Apache Juneau through version 9.2.0 where the RestClient improperly retains credential headers during HTTP redirects. This allows sensitive headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key to be sent to unintended hosts or downgraded protocols. The issue is fixed in version 9.2.1.

Apache Juneau versions prior to 9.2.1 have a vulnerability where error responses expose internal exception class names and messages to remote clients. This occurs through the 'Thrown' response header and may also include internal exception messages in the error body, even if stack-trace rendering is disabled. This information disclosure reveals implementation details that could aid attackers. The issue is fixed in version 9.2.1.

CVE-2026-73100 is a critical vulnerability in Apache Juneau up to version 9.2.0 where sensitive information such as Authorization headers and API keys are logged in cleartext when a server error occurs. This exposure occurs because the default REST server call logger does not redact sensitive request headers before writing them to application logs. The issue is fixed in version 9.2.1.

Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.

Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer. The impact depends on the classes present in the deployment. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

CVE-2026-123025 is a critical OS Command Injection vulnerability in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin up to version 4.17. A remote authenticated user with privileges to issue or renew certificates via the WebGUI or API can execute arbitrary commands as root due to unsafe interpolation of user-controlled fields into shell commands without validation or escaping.

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.

The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.

An integer underflow vulnerability exists in the dstarCallsignToAPRS function within APRSUtils.cpp in G4KLX DStarGateway and F4FXL DStarGateway before commit 7b75de6. This occurs via an empty RS-MS1A sender field. The vulnerability has a critical severity with a CVSS 4.0 score of 9.2.

Kyverno versions from 1.16.0 up to but not including 1.19.2 contain a vulnerability where path segments in the resource argument of resource.get() and resource.post() are not properly validated. This flaw allows namespaced CEL policies to escape their namespace boundaries. An attacker with the ability to create a NamespacedValidatingPolicy can exploit this by inserting '..' segments to read and write arbitrary cluster objects via the admission controller's ServiceAccount, potentially leading to full cluster takeover.

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain a critical privilege escalation vulnerability. This flaw allows namespace-scoped tenants to modify resources in other namespaces by exploiting a lack of namespace checks in the NamespacedMutatingPolicy targetMatchConstraints.expression CEL output. Attackers can manipulate cluster-wide background controllers to mutate RoleBindings, Roles, NetworkPolicies, and ConfigMaps belonging to other tenants.

Kyverno versions from 1.19.1 up to but not including 1.19.2 contain a vulnerability where the Policy's context.apiCall urlPath is validated after cleaning but executed using the raw path. This allows a namespace-scoped user with Policy creation permissions to craft a urlPath containing hidden '../' segments behind '#' or '?' characters to access cluster-scoped endpoints with Kyverno's ServiceAccount privileges, effectively gaining cluster admin rights.

Kyverno versions 1.18.0 up to but not including 1.19.2 contain a vulnerability in the verifyImages function where signature verification can be bypassed. This occurs because cached verification results are keyed by image reference strings (e.g., tags) rather than the verified image digest. An attacker able to submit workloads and manipulate registry tags can exploit this to bypass signature and attestation checks, causing Kyverno to admit workloads with unverified images.

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace administrators to escape their namespace confinement by exploiting the cleanup controller's context loader, which is built with a nil policy. Attackers can leverage this to read Secrets across namespaces and modify validating webhook configurations using the cleanup controller's ServiceAccount.

Kyverno versions prior to 1.19.2 have a critical privilege escalation vulnerability. This flaw allows namespace administrators to create resources beyond their assigned RBAC permissions. The issue arises because generate-rule admission checks validate the controller's permissions instead of the resource author's. Consequently, attackers can craft namespaced Policies with generate rules that target other namespaces or cluster-scoped resources, causing the background controller to create or clone resources across the cluster.