Search: 17.9-6

ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 contain an improper authorization vulnerability. The flaw occurs when issuing passkey or passwordless enrollment codes, where the system verifies only the organization in the x-zitadel-orgid header instead of the target user's organization. This allows attackers with user-write permission in one organization to obtain enrollment codes for users in other organizations on the same instance and register their own authenticators, effectively taking over those accounts.

ZITADEL versions 4.x before 4.17.3 and 3.x through 3.4.15 use unauthenticated, malleable encryption to protect IdP intent tokens. This flaw allows authenticated users to tamper with their own tokens to impersonate another user's external login intent. An attacker who can predict a victim's in-flight intent identifier and win a timing race may steal the victim's IdP tokens or hijack their session.

CVE-2026-97307 is a vulnerability in StylemixThemes Cost Calculator Builder up to version 4.0.17 that allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. This issue affects all versions from initial release through 4.0.17. The vulnerability has a high severity with a CVSS score of 7.5 and does not require user interaction or privileges to exploit.

WP Ultimate CSV Importer versions 7.17 up to but not including 9.2 contain a stored cross-site scripting (XSS) vulnerability. The plugin fails to properly validate and sanitize file types and their contents in uploaded archives before storing them in publicly accessible locations. This allows high privilege users, such as administrators, to inject malicious scripts. On Multisite WordPress installations, site administrators without unfiltered_html capability can exploit this to run scripts in the context of other users, including Network Super Admins. The vulnerability is fixed in version 9.2.

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter in all versions up to, and including, 4.17.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is exploitable via any page hosting the ProfilePress Tabbed Widget by supplying a malicious filename for the ppress_billing_address file upload field in a crafted POST request.

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.

CVE-2026-59265 is a high-severity code execution vulnerability in Apache OpenOffice up to version 4.1.16. It arises from an untrusted search path issue in the Java integration, allowing a crafted document to execute arbitrary code when opened. The issue is fixed in version 4.1.17, currently in release candidate phase. Users can mitigate the risk by disabling Java runtime integration or avoiding opening untrusted files until the update is applied.

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large Roman numerals. ### Patches This has been fixed in [pypdf==6.17.0](https://github.com/py-pdf/pypdf/releases/tag/6.17.0). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4047](https://github.com/py-pdf/pypdf/pull/4047).

Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count, because the level count L read when parsing an HSS public key was not checked against the RFC 8554 maximum of 8, and signature parsing then allocated an array of L - 1 entries before reading any further signature data. A single verification can commit up to about 17 GB of memory or fail with an OutOfMemoryException.

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an administrator viewing the log and send their browser to an attacker-controlled page.

Red Hat Satellite 6.17.12 includes a critical security update addressing multiple vulnerabilities across components such as Foreman, GitPython, Dynaconf, Golang libraries, and others. These vulnerabilities include command injection, remote code execution, information disclosure, denial of service, and authorization bypass issues. The update fixes issues like command injection in job invocations, unauthenticated information disclosure, server-side template injection, and arbitrary code execution via improper validation in GitPython. The advisory also includes bug fixes unrelated to security.

Red Hat Quay 3.17.5 is a security update that addresses multiple bugs and vulnerabilities in the Quay container registry platform. The update includes fixes for issues such as limiting Clair image scanning attempts, cleaning up orphaned multipart uploads, repository mirroring problems, UI routing bugs, LDAP password redaction, and other functional and security improvements. The advisory references multiple CVEs but does not provide detailed descriptions of individual vulnerabilities. The update is classified as important and addresses known issues to improve stability and security.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.17.58. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:70587 Security Fix(es): * github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env (CVE-2026-15809) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.58. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:70585 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/ Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012) * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.

This update for jline3 fixes the following issue: Update to upstream version 3.30.17: * Security Fixes + Native Stack Buffer Overflow in Public INPUT_RECORD.memmove JNI Method (Windows) (GHSA-6r3w-6jpj-x5w6) + Authenticated SSH Shell Channel Resource Leak via Null or Non-Numeric PTY Dimensions (GHSA-7h86-pjwh-gpqj) + Authenticated SSH DoS via Unbounded Window-Change Terminal Geometry (GHSA-m935-wqpj-pvp3) + TCP Socket File Descriptor Leak When Maximum Connections Reached (GHSA-c87g-867h-cqr6) * Bug Fixes + strip control characters from file names in posix builtins + bound !# history expansion to prevent exponential blowup + verify server host keys in the ssh client builtin + address remaining security vulnerabilities reported by AFINE/CERT.PL + backport security fixes from master + backport security fixes to 3.x (path traversal + DSR plain text) + strip control characters from ssh banner and prompts * Dependency updates + bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.10.2 + bump slf4j.version from 2.0.18 to 2.0.19 + bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 + bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 + bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.2 + bump actions/setup-java from 5 to 6.0.0 + bump org.graalvm.sdk:graal-sdk from 25.1.3 to 25.3.4.1 + bump com.mycila:license-maven-plugin from 5.0.0 to 5.1.2 + bump org.easymock:easymock from 5.6.0 to 5.7.0 + bump com.google.jimfs:jimfs from 1.3.1 to 1.3.2 + bump org.apache.maven.wrapper:maven-wrapper from 3.3.2 to 3.3.4 + bump org.apache.maven:apache-maven from 4.0.0-rc-3 to 4.0.0-rc-6 + bump eu.maveniverse.maven.njord:extension3 from 0.9.9 to 0.9.10 + bump com.palantir.javaformat:palantir-java-format from 2.96.0 to 2.97.0 + bump release-drafter/release-drafter from 7.6.0 to 7.7.0 + bump groovy.version from 4.0.32 to 4.0.33 + bump release-drafter/release-drafter from 7 to 7.6.0 + bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 - Update to upstream version 3.30.16 * bugfix release with security hardening, SSH agent forwarding fix, and terminal compatibility improvements. * Breaking Changes + SSH agent forwarding is no longer enabled by default; pass -A to explicitly request it + reject overlong hex components in OSC color responses + strip OSC and other escape sequences in ansiAppend + search multiple lib paths for versioned libutil.so + use Path.resolve instead of URI.resolve in cat and sort to prevent SSRF + check closed flag in PtyInputStream to prevent hang on empty input + confine ConfigurationPath lookups to the config directory + disable Read File command in nano restricted mode + drain buffered data before EOF in NonBlockingPumpInputStream + look up openpty in libc.so.6 for glibc 2.34+ + guard styleMatches and highlighter rules against ReDoS + backport telnet DoS mitigations (GHSA-47qp, GHSA-2r2c) + propagate EOF in PtyInputStream to avoid infinite loop + bump org.apache.ivy:ivy from 2.5.3 to 2.6.0 + bump actions/setup-node from 6 to 7 + bump com.palantir.javaformat:palantir-java-format from 2.94.0 to 2.96.0 + bump sshd.version from 2.18.0 to 2.19.0 + bump org.codehaus.gmavenplus:gmavenplus-plugin from 5.0.0 to 5.1.0 + bump org.graalvm.sdk:graal-sdk from 25.0.3 to 25.1.3 + bump com.diffplug.spotless:spotless-maven-plugin

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.58. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:70585 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work the user then performs in that session, including uploads, form submissions, and account bindings, lands in the attacker's account. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.