Red Hat has released a security advisory for kernel live patch modules targeting kernel-5.14.0-687.10.1.el9_8. The update addresses multiple vulnerabilities in the Linux kernel related to netfilter ebtables, pppoe header handling, bridge port group deletion, packet header length consistency, and xfrm ah6 routing header validation. These vulnerabilities have been rated as important by Red Hat Product Security. The advisory provides updated packages for Red Hat Enterprise Linux 9 and its variants.
Red Hat issued a moderate severity security advisory for the Linux kernel addressing two vulnerabilities related to BPF JIT hardening and x86 bug mitigations. The update includes support for hardening against JIT spraying (CVE-2026-64508) and enabling IBPB flush on BPF JIT allocation (CVE-2026-64507). These fixes improve kernel security by mitigating potential attack vectors involving the BPF Just-In-Time compiler. The update requires a system reboot to take effect and is applicable to Red Hat Enterprise Linux 10.0 Extended Update Support and related products.
Red Hat has issued a security update for osbuild-composer, a service that builds customized OS artifacts including VM images and OSTree commits. The update addresses multiple vulnerabilities primarily involving denial of service and man-in-the-middle attack vectors in various Go language components used by osbuild-composer. These include issues in MongoDB Go Driver, gRPC-Go, golang net/http, crypto/tls, mime/multipart, HTTP/2 handling, and crypto/x509. The vulnerabilities affect Red Hat Enterprise Linux 10.0 Extended Update Support across multiple architectures.
CVE-2026-16020 is a stored cross-site scripting (XSS) vulnerability in the DefterAsist Financial Advisor Platform by Fazile BACAK. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that persist on the platform. It affects versions up to and including 2026-10-27. The CVSS 3.1 base score is 5.4, indicating a medium severity level.
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can store a malicious block via the REST API in a pending post and trigger server-side rendering by previewing that post, bypassing wp_magic_quotes since the attribute is sourced from post_content via parse_blocks rather than a superglobal.
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() applied at save time does not neutralize the payload because the injection lands in an HTML-attribute context where only a raw double-quote is needed to break out, and block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time.
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom, …)' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'conversion' Shortcode Attribute in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Royal MCP WordPress plugin versions before 1.5.10 have a vulnerability where the plugin does not perform an object-level permission check before duplicating a requested page. This flaw allows users with contributor-level access to read the full content of any private or draft page and publish it without having the publish capability.
The Royal MCP WordPress plugin versions before 1.5.10 lack proper object-level and post-type authorization checks in one of its search tools. This vulnerability allows authenticated users with low privileges, such as subscribers, to access the title and content of non-public entries, potentially exposing personal data stored by the plugin.
CVE-2026-118275 is a medium severity vulnerability in a2ui-project a2ui up to version 0.10.6 affecting the DataContext.resolveSignal function. The flaw allows remote attackers to cause resource consumption, leading to a denial-of-service condition. Public exploit code exists for this issue. A patch has been identified to fix the vulnerability.
A vulnerability in the Linux kernel's p54 wifi firmware parser allows reading beyond the bounds of firmware records due to insufficient validation of record lengths. This flaw can cause the parser to read past the intended data fields when processing malformed firmware records. The issue has been addressed by validating component ID and version record lengths and rejecting descriptor values that cause underflow or empty ranges before updating driver state.
CVE-2026-118276 is a medium severity vulnerability in the a2ui-project a2ui software up to version 0.10.6. It affects the formatString function in the Parser component, causing resource consumption when exploited remotely. Public exploit code is available. A patch identified by commit 1f71d1aac1b145ef57c7526f9e0cff316f5934e2 is recommended to fix the issue.
Red Hat has released a security advisory for multiple vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 10.2 Extended Update Support. The update addresses several security issues including privilege restrictions, use-after-free bugs, and kernel panic fixes. The kernel is a critical component of the operating system, and these fixes improve overall system security and stability. Systems must be rebooted after applying the update for changes to take effect.
A vulnerability in a2ui-project a2ui up to version 0.10.6 affects the DataModel.set function in the file renderers/web_core/src/v0_9/state/data-model.ts. This flaw allows remote attackers to cause resource consumption, potentially leading to denial of service. Exploit code has been published. A patch identified by commit 82789191ce551f4d7a095d273773fb24bd764c9d is available to remediate the issue.