Search: 17.9-6

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

Red Hat OpenShift Container Platform 4.17.58 includes security updates addressing multiple denial of service vulnerabilities in various components such as brace-expansion, js-yaml, and Go HTTP/2. These vulnerabilities could allow an attacker to cause memory exhaustion or service disruption. Users of OpenShift Container Platform 4.17 are advised to upgrade to the updated packages and container images to mitigate these issues.

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler WordPress plugin before 1.8.17 or passes a request-derived URL to its public cache-clearing hook.

CVE-2026-102993 is a high-severity vulnerability in the pypdf Python library prior to version 6.17.0. It involves uncontrolled resource consumption caused by processing crafted PDF files with unusually large Roman page-label values. This leads to excessive memory use and potential application unavailability. The issue is fixed in pypdf version 6.17.0.

Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.

Author SQL Injection in WP ERP <= 1.17.9 versions.

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

This update includes the following RPMs: nodejs24: * nodejs24-24.21.0-1.1.hum1 (aarch64, x86_64) * nodejs24-bin-24.21.0-1.1.hum1 (noarch) * nodejs24-devel-24.21.0-1.1.hum1 (aarch64, x86_64) * nodejs24-docs-24.21.0-1.1.hum1 (noarch) * nodejs24-full-i18n-24.21.0-1.1.hum1 (aarch64, x86_64) * nodejs24-libs-24.21.0-1.1.hum1 (aarch64, x86_64) * nodejs24-npm-11.19.0-1.24.21.0.1.1.hum1 (noarch) * nodejs24-npm-bin-11.19.0-1.24.21.0.1.1.hum1 (noarch) * v8-13.6-devel-13.6.233.17-1.24.21.0.1.1.hum1 (aarch64, x86_64) * nodejs24-24.21.0-1.1.hum1.src (src) Security Fix(es): nodejs24: * CVE-2026-102278

The npm package 'reactjs-risk' versions 99.17.1 and 99.17.2 contains malicious code that executes during installation. Its preinstall script collects host identity metadata including hostname, username, and platform, encodes this data, and sends it via DNS lookup to a third-party domain without user consent. The package's main entry point is a non-functional stub, indicating the sole purpose is to exfiltrate installer information. This behavior is deliberately obfuscated to evade detection.

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.

CVE-2026-85573 is a high-severity Cross-Site Scripting (XSS) vulnerability in the All in One Files Upload WordPress plugin versions 2.0.3 up to but not including 2.0.17. The plugin improperly adds SVG files to allowed upload types without sanitizing them or verifying the authenticity of upload requests. This flaw allows unauthenticated users to upload files containing active content that executes in the site's origin when accessed by a victim.

A vulnerability in the Joi validation library's isoDate string validation allows an attacker to cause a denial of service by sending a specially crafted string. The issue arises from a quadratic regular-expression backtracking problem that causes the validation to stall for a time proportional to the square of the input length. This can lead to significant application delays or stalls. Fixed versions are available in Joi 17.13.7 and 18.2.6.

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

CVE-2026-100766 is an information disclosure vulnerability in the Networking: JAR component of Firefox. The issue allows unauthorized disclosure of information. This vulnerability has been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The CVSS v3.1 base score is 4.3, indicating a medium severity level.

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVE-2026-100818 is a critical use-after-free vulnerability in the Widget: Gtk component of Mozilla Thunderbird that allows sandbox escape. This flaw was fixed in Thunderbird versions 140.17, 153.4, and 157, as well as corresponding Firefox ESR versions. The vulnerability has a high CVSS score of 9.6, indicating it can lead to complete system compromise if exploited. No known exploits are reported in the wild at this time.

CVE-2026-100811 is a critical use-after-free vulnerability in the DOM Core & HTML component of Mozilla Thunderbird that allows sandbox escape. This flaw has been fixed in Thunderbird versions 140.17, 153.4, and 157. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Users should update to the fixed versions to mitigate the risk.

CVE-2026-100803 is a high-severity vulnerability in Mozilla Firefox involving a same-origin policy bypass in the WebExtensions component. This flaw allows an attacker to bypass security restrictions that normally prevent web content from accessing data from other origins. The issue has been fixed in multiple Mozilla products including Firefox ESR 153.4, Firefox 157, Thunderbird 140.17, 153.4, and 157, as well as Firefox ESR 115.42 and 140.17.