Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.
Security Fix(es):
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198)
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197)
* FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
* freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
* freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
* ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
* ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
* freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)
Bug Fix(es) and Enhancement(s):
* Fix ipatests for kdcproxy after CVE-2025-59088 fix (JIRA:RHEL-129969)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management.
Security Fix(es):
* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-116223 is a medium-severity vulnerability in icret EasyImage versions 2.8.0 through 2.8.7. It involves improper privilege management due to manipulation of the 'hash' argument in the app/del.php file. This flaw can be exploited remotely without authentication. A patch identified by commit b12cb67d447bcbb67e21c8f011d0f5638229760c has been released to fix the issue. Exploit code is publicly available, increasing the risk of exploitation.
The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.
Security Fix(es):
* FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504)
* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507)
* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506)
* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509)
* FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505)
* freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508)
Bug Fix(es) and Enhancement(s):
* Update freeipmi to 1.6.20 to fix two potential buffer overflows [rhel-9.8.z] (JIRA:RHEL-279523)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor.
This content announces the creation of an AI Security Wiki and an AI Secure by Design project, which provide a comprehensive, vendor-neutral resource for AI security governance, risk management, architecture, standards, and compliance. The authors emphasize that many recent AI-related security incidents stem from failures in fundamental security practices rather than AI technology itself. The projects aim to help organizations integrate security fundamentals into AI development and deployment to mitigate risks associated with AI-assisted attacks.
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).
CVE-2026-115893 is a critical vulnerability in the bytecodealliance wasmtime runtime for WebAssembly on aarch64 platforms using the Cranelift compiler backend. Versions prior to 36.0.19, between 37.0.0 and before 48.0.7, and between 49.0.0 and before 49.0.4 are affected. The flaw allows a user-controlled WebAssembly module to escape the sandbox by exploiting an incorrect conditional branch target when compiling a br_table instruction with more than approximately 256,000 targets. This can lead to arbitrary code execution outside the sandbox. The issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks.
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Two critical unauthenticated remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, were publicly disclosed in October 2026. These vulnerabilities have a high severity score (CVSS 9.2) and affect PHP's memory management, enabling reliable exploitation when chained. The disclosure triggered immediate emergency responses from criminal forum operators, who took their platforms offline, migrated infrastructure, and restricted new registrations to mitigate risk. These forums store sensitive data such as member identities, private communications, and stolen credentials, making the vulnerabilities a significant threat to their operations. The adversary economy's reaction mirrors legitimate enterprise incident response, highlighting the severity of the vulnerabilities. No specific affected PHP versions are detailed in the provided data.