Critical severity threats

CVE-2026-122992 is a critical integer underflow vulnerability in G4KLX DStarGateway and F4FXL DStarGateway before commit 7b75de6. The flaw occurs in the function dstarCallsignToAPRS in APRSUtils.cpp when processing an empty RS-MS1A sender field, leading to an integer underflow condition.

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain a critical privilege escalation vulnerability. This flaw allows namespace-scoped tenants to modify resources in other namespaces by exploiting a lack of namespace checks in the NamespacedMutatingPolicy targetMatchConstraints.expression CEL output. Attackers can manipulate cluster-wide background controllers to alter RoleBindings, Roles, NetworkPolicies, and ConfigMaps in other namespaces. The vulnerability is fixed in version 1.19.2.

Kyverno versions from 1.16.0 up to but not including 1.19.2 contain a path traversal vulnerability in the resource.get() and resource.post() functions. This flaw allows namespaced CEL policies to escape their namespace by inserting '..' segments in the resource argument, enabling unauthorized read and write access to arbitrary cluster objects via the admission controller's ServiceAccount. This can lead to a complete cluster takeover. The issue is fixed in version 1.19.2.

CVE-2026-122310 is a critical vulnerability in Kyverno versions 1.19.1 up to but not including 1.19.2. It arises from a discrepancy between how Kyverno validates and executes the Policy's context.apiCall urlPath, allowing a namespace-scoped user with Policy creation rights to exploit URL fragments or queries to access cluster-scoped endpoints with elevated privileges. This can lead to cluster admin access.

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace administrators to escape their namespace confinement due to the cleanup controller using a nil policy context loader. Exploiting this, attackers can create namespaced CleanupPolicy resources with specific context entries to read Secrets across namespaces and modify validating webhook configurations using the cleanup controller's ServiceAccount.

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace tenants to overwrite resources in other namespaces by exploiting the NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. An attacker can craft a CEL map literal that fabricates a target with an attacker-chosen metadata.namespace, enabling the privileged background controller to overwrite critical cluster-wide resources such as Secrets, Deployments, or policies. The vulnerability is rated critical with a CVSS 4.0 score of 9.4 and has been fixed in version 1.19.2.

Kyverno versions before 1.19.2 have a privilege escalation vulnerability that allows namespace administrators to create resources beyond their assigned RBAC permissions. This occurs because generate-rule admission checks validate the controller's permissions rather than the resource author's. As a result, attackers can craft namespaced Policies with generate rules targeting other namespaces or cluster-scoped resources, causing the background controller to create or clone resources cluster-wide.

A critical security vulnerability in Keycloak involves the jackson-databind library improperly validating the outer class of a class-name type ID while accepting attacker-controlled classes inside generic arguments. This flaw allows an attacker to bypass type restrictions, potentially leading to severe impacts on confidentiality, integrity, and availability. The vulnerability affects Keycloak versions prior to 26.8.1-r1 and has a CVSS score of 9.8. A fix is available in version 26.8.1-r1.

A critical buffer overflow vulnerability exists in the Brotli decoder component of Keycloak, identified as CVE-2026-111497. This flaw affects Keycloak versions prior to 26.8.1-r1 and can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability has a high CVSS score of 9.8, indicating severe impact if exploited. A fix is available in version 26.8.1-r1.

A critical security vulnerability (CVE-2026-71885) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.8.1-r1. The flaw has a high CVSS 4.0 score of 9.2, indicating severe impact. A fix is available in version 26.8.1-r1.

A critical security vulnerability (CVE-2026-112393) affects the apache-superset package due to an issue in the Pillow Python imaging library. The flaw has a CVSS score of 9.8, indicating high severity with network attack vector, no required privileges or user interaction, and impacts confidentiality, integrity, and availability. Fixed versions 2021.38.2-r0 and 2021.36.5-r0 are available.

A critical security vulnerability (CVE-2026-96639) affects the apache-superset package due to an issue in the Pillow Python imaging library. The flaw impacts versions of apache-superset prior to 2021.36.5-r0 and 2021.38.2-r0. The vulnerability has a high CVSS score of 9.8, indicating severe potential impact on confidentiality, integrity, and availability. Fixed versions are available, and patches should be applied to mitigate the risk.

A critical security vulnerability (CVE-2026-112900) affects the apache-superset package due to an issue in the Pillow Python imaging library. The flaw has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges required, and impacts confidentiality, integrity, and availability. Fixed versions are 2021.36.5-r0 and 2021.38.2-r0.

A critical security vulnerability (CVE-2026-112403) affects the apache-superset package due to an issue in the Pillow Python imaging library. The flaw has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges required, and no user interaction needed. Fixed versions 2021.36.5-r0 and 2021.38.2-r0 address this vulnerability.

A critical security vulnerability (CVE-2026-112398) affects the apache-superset package due to an issue in the Pillow Python imaging library. The flaw has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Fixed versions 2021.36.5-r0 and 2021.38.2-r0 are available to remediate the issue.

A critical command injection vulnerability exists in Edimax BR-6208AC firmware version 1.32, specifically in an unknown functionality of the /goform/mp endpoint. This flaw allows remote attackers to execute arbitrary commands without authentication. Exploit code has been published, increasing the risk of exploitation. The vendor has not responded to disclosure attempts, and no patch information is available.

VitaFit cloud API versions before 2026-10-30 have an authentication bypass vulnerability. Remote attackers can submit a linked Google or Facebook account identifier to the login endpoint without proof of ownership, gaining full session access to the victim's account. This allows attackers to read and modify the victim's profile and delete authentication records, blocking legitimate user access.

VitaFit cloud API versions before 2026-10-30 have a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials via the POST /front/user/s3/token/ endpoint. These credentials are improperly scoped, enabling attackers to list the shared storage bucket and read or overwrite files belonging to other users. This results in unauthorized cross-user data access and manipulation.

Multiple critical security vulnerabilities have been identified and fixed in the ANGLE component used by the chromium-browser within the webkit2gtk3 package on Red Hat Enterprise Linux 9.6. These include arbitrary code execution, information disclosure, use-after-free, buffer overflow, improper input validation, and uninitialized resource issues. The update also addresses a regression affecting Eclipse IDE WebKit-based views. The vulnerabilities are rated critical and affect the ANGLE graphics engine used by Chromium-based browsers.