The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know.
This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
HashiCorp Vault and Vault Enterprise versions prior to 2.1.2 (Community Edition) and certain 1.x Enterprise versions improperly handle case sensitivity when evaluating ACL policies. This flaw allows authenticated users with delegated permissions to bypass explicit deny restrictions, potentially accessing protected resources or assigning denied policies, leading to privilege escalation. The vulnerability is fixed in Vault Community Edition 2.1.2 and Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
CVE-2026-105820 is a path traversal vulnerability in HashiCorp Vault Enterprise's ACL policy cache. It allows tokens with specially crafted policy names containing path traversal constructs to access capabilities of policies in other namespaces, including the root namespace. This issue affects Vault Enterprise versions prior to 1.21.12 and has been fixed in versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition is not affected as it does not support namespaces.
CVE-2026-105816 is a path traversal vulnerability in HashiCorp Vault and Vault Enterprise that allows a privileged operator to execute arbitrary code on the Vault host when restoring an Integrated Storage (Raft) snapshot with an external plugin directory configured. The issue arises because Vault did not consistently verify that plugin catalog entries reference binaries only within the configured plugin directory. This vulnerability has a high severity score of 8.0 and is fixed in Vault Community Edition 2.1.2 and Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
HashiCorp Vault's PKI secrets engine ACME server had a vulnerability where it did not restrict certificate identities that were not validated by ACME challenges under the default directory policy. This could allow an ACME client to obtain a certificate with unverified identity claims, potentially enabling impersonation against systems trusting certificates from the affected Vault PKI mount. The issue is fixed in Vault Community Edition 2.1.2 and Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
An authenticated user of Backstage can exploit improper input validation in the proxy-backend plugin to cause the proxy to forward requests to paths outside the intended base path on configured target servers. This vulnerability requires authentication and affects versions of @backstage/plugin-proxy-backend prior to 0.6.17. A patch is available in version 0.6.17. As a workaround, deploying a reverse proxy or WAF to normalize request paths can mitigate the issue.
CVE-2026-106492 is a vulnerability in the @backstage/backend-defaults package where access restrictions on external service credentials can be bypassed during plugin delegation. This allows a service credential configured with limited permissions (e.g., read-only) to perform unauthorized operations such as write actions on plugins it should only read. The issue is patched in version 0.17.8 of the package.
CVE-2026-106494 is a medium severity vulnerability in the @backstage/backend-defaults package where improper input validation in cloud storage URL readers allows an attacker with write access to a cloud storage bucket to craft object names that collide with protected files in the output directory, potentially leading to content injection. This issue is patched in version 0.17.8.
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection.
This issue affects The Events Calendar: from n/a through 6.17.4.
— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH). This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
CVE-2026-92414 is a critical session fixation and session reuse vulnerability in Apache Jackrabbit's WebDAV server. The flaw allows the server to attach a cached authenticated session based solely on matching certain header tokens (Lock-Token, TransactionId, SubscriptionId, If-header) without verifying credentials. This can lead to session reuse across different users. Versions 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5 are affected. Fixed versions are 2.20.18, 2.22.5, and 2.23.6.
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In sol_pdu_decrypt(), out is allocated as NET_BUF_SIMPLE(17) and then filled with net_buf_simple_add_mem(out, in->data, in->len); net_buf_simple_add() guards its tailroom only with __ASSERT_NO_MSG, which is compiled out in production builds, so when in->len > 17 the underlying memcpy writes attacker-controlled bytes past the 17-byte stack buffer. The copy occurs before any decryption or authentication, so no key material is required to trigger it.
The oversized length arises because the mesh scan callback in subsys/bluetooth/mesh/adv.c calls net_buf_simple_restore() before dispatching to bt_mesh_sol_recv(), leaving buf->len covering the entire remaining advertising payload rather than just the Solicitation Service Data. After the parser locates the Service Data AD and consumes the Identification Type byte, the remaining buf->len is the 17-octet Network PDU plus any trailing advertising bytes, and prior to this fix there was no maximum-length check (only a minimum). An attacker can therefore append extra AD structures or padding after the Solicitation Service Data to make buf->len exceed 17.
bt_mesh_scan_cb() is registered directly as the BLE scan callback, so buf is raw, unauthenticated advertising data received over the air. Any device in radio range can send a non-connectable advertisement carrying a crafted mesh Proxy Solicitation to a node that has CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled and is currently eligible to be solicited (GATT proxy disabled, On-Demand Private Proxy enabled), with no pairing, bonding, or provisioning. The result is an attacker-controlled stack overwrite — plausibly leading to remote code execution and at minimum a reliable remote denial of service. The fix trims buf->len to the spec-fixed 17 octets (dropping the PDU if fewer remain) before decryption.
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
CVE-2026-102407 is an incorrect authorization vulnerability in Elastic Elasticsearch that allows an authenticated user with privileges on one resource to modify data streams they are not authorized to access. This vulnerability affects multiple Elasticsearch versions from 7.17.5 through 9.4.3. It does not permit unauthorized reading of data stream contents but can lead to unauthorized modification or injection of data, potentially disrupting search functionality. The CVSS score is 5.4, indicating medium severity.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.22.17. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:74429
Security Fix(es):
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat OpenShift Container Platform 4.22.17 includes important security fixes addressing multiple vulnerabilities in components such as libevent, the Linux kernel, and Unbound DNS resolver. These issues range from access control bypass risks to remote code execution and buffer overflow vulnerabilities. Users of OpenShift Container Platform 4.22 are advised to upgrade to this release to mitigate these security risks.
A vulnerability in the Linux kernel's AMDGPU driver causes a memory leak due to skipped unmapping of register BAR ioremap mappings during device removal. This occurs because drm_dev_unplug() is called before fini_sw(), causing the iounmap() call to be skipped. The issue affects Linux kernel version 5.17 and has been fixed in subsequent commits.