CVE-2026-93852 is a high-severity vulnerability in OpenStack Blazar before version 17.0.1. It involves missing authorization checks in the V2 lease listing API, allowing any authenticated user to enumerate leases across all projects without proper project scoping or admin-only restrictions. This exposure reveals sensitive lease-related identifiers and metadata, which can be leveraged to bypass object-level authorization controls and modify or delete leases.
OpenStack Blazar versions before 17.0.1 have a vulnerability in the V2 lease API where object-level authorization is not properly enforced on update and delete operations. This is due to a mismatch in parameter naming during lease lookup, causing authorization to fallback incorrectly. As a result, any authenticated user who knows a lease ID can modify or delete leases owned by other users or projects, bypassing intended ownership checks.
CVE-2026-11722 is an HTTP request smuggling vulnerability affecting IBM WebSphere Application Server versions 8.5 and 9.0, as well as IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.5. This vulnerability could allow an attacker to interfere with the processing of HTTP requests, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating with a CVSS score of 4.8.
CVE-2026-11549 is a medium severity vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, and Liberty versions 17.0.0.3 through 26.0.0.5. It involves improper access control that allows a virtual host bypass. This could lead to limited confidentiality and integrity impacts without requiring privileges or user interaction.
CVE-2026-11548 is an HTTP request smuggling vulnerability affecting IBM WebSphere Application Server versions 8.5, 9.0, and IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.5. This vulnerability allows an attacker to interfere with the processing of HTTP requests, potentially leading to information disclosure and integrity impacts. The CVSS score is 4.8 (medium severity), indicating a moderate risk. No public exploits or known active exploitation have been reported. Patch status is not confirmed as no patch links or vendor advisories are provided.
PJSIP pjproject versions 2.17 and earlier have an improper certificate validation vulnerability in the OpenSSL and GnuTLS backends. The flaw involves incorrect handling of DNS SubjectAltName values containing embedded NUL bytes, allowing an attacker with a specially crafted certificate from a trusted issuer to impersonate a target server during TLS verification. This can lead to interception of SIP sessions and theft of REGISTER credentials. The mbedTLS backend is not affected. No fixed version is currently available.
PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept untrusted AVI sources expose a stronger memory-corruption condition. No fixed version is available as of this review.
CVE-2026-10841 is a medium severity vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, Liberty 17.0.0.3 through 26.0.0.5, and version 10.1. It involves inconsistent interpretation of HTTP requests, known as HTTP request/response smuggling (CWE-444). This flaw could allow an attacker to manipulate HTTP request processing, potentially impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 4.8, indicating a moderate risk. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdma_accept_failed error path of smbdirect_accept_connect_request(), the receive io posted just above is owned by the QP (recv_io is set to NULL after a successful post). The error path fell through to smbdirect_connection_destroy_mem_pools() before smbdirect_connection_destroy_qp(), so the mem pools and the recv_io slab cache were destroyed while that recv_io was still outstanding on the QP. The drain in smbdirect_connection_destroy_qp() (ib_drain_qp()) is what runs the recv completion that returns the recv_io to the free list, so destroying the pools first leaves the object outstanding at kmem_cache_destroy() time ("Slab cache still has objects") and later frees it into an already-destroyed mempool (mempool_free_bulk NULL-pointer dereference). Give rdma_accept_failed its own teardown that drains the QP first, then destroys the mem pools, and returns. The remaining labels (post_recv_io_failed onward) run before the recv_io was ever posted, so they keep the mem-pools-then-qp order. The outstanding recv_io at kmem_cache_destroy() time: [ 3487.344647] ============================================================================= [ 3487.349942] BUG smbdirect_recv_io_cache_ffff88811ba99000 (Not tainted): Objects remaining on __kmem_cache_shutdown() [ 3487.356078] ----------------------------------------------------------------------------- [ 3487.356078] [ 3487.356738] Object 0xffff8881511c3440 @offset=13376 [ 3487.358464] Allocated in mempool_alloc_noprof+0x18c/0x290 age=1194 cpu=6 pid=22254 [ 3487.361197] mempool_alloc_noprof+0x18c/0x290 [ 3487.361542] smbdirect_connection_create_mem_pools+0x405/0x780 [ 3487.361972] smbdirect_accept_connect_request+0x5a8/0x1b80 [ 3487.362359] smbdirect_listen_rdma_event_handler+0x1579/0x1b90 [ 3487.362779] cma_cm_event_handler+0x9c/0x230 [ 3487.363096] cma_ib_req_handler+0x2682/0x45d0 [ 3487.363414] cm_process_work+0x56/0x3d0 [ 3487.363676] cm_work_handler+0x8a0e/0xd000 [ 3487.367496] process_scheduled_works+0xa07/0x13a0 [ 3487.367859] worker_thread+0x7c9/0xc80 [ 3487.368148] kthread+0x341/0x430 [ 3487.368407] ret_from_fork+0x3a8/0x7a0 [ 3487.368704] ret_from_fork_asm+0x1a/0x30 [ 3487.370307] Slab 0xffffea0005447000 objects=19 used=1 fp=0xffff8881511c0040 flags=0x100000000000240(workingset|head|node=0|zone=2) [ 3487.372840] ------------[ cut here ]------------ [ 3487.373195] WARNING: mm/slub.c:1244 at __slab_err+0x1a/0x30, CPU#6: kworker/6:84/22254 [ 3487.373759] Modules linked in: [ 3487.373993] CPU: 6 UID: 0 PID: 22254 Comm: kworker/6:84 Tainted: G B 7.1.0-next-20260623+ #88 PREEMPT(lazy) [ 3487.374778] Tainted: [B]=BAD_PAGE [ 3487.377830] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 3487.378515] Workqueue: ib_cm cm_work_handler [ 3487.378820] RIP: 0010:__slab_err+0x1a/0x30 [ 3487.379129] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 e8 36 00 00 00 bf 05 00 00 00 be 01 00 00 00 e8 f7 75 45 00 90 <0f> 0b 90 c3 cc cc cc cc cc 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 [ 3487.383255] RSP: 0018:ffff888220fc7050 EFLAGS: 00010093 [ 3487.383643] RAX: ffffffff8168e60a RBX: ffff88810955e640 RCX: ffff88821c381d80 [ 3487.384158] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff870fa080 [ 3487.384662] RBP: ffff888220fc7068 R08: ffffffff870fa087 R09: 1ffffffff0e1f410 [ 3487.385192] R10: dffffc0000000000 R11: fffffbfff0e1f411 R12: ffffea0005447210 [ 3487.385674] R13: ffffea0005447000 R14: ffff888220fc7068 R15: ffff88812a8ab300 [ 3487.388932] FS: 0000000000000000(0000) GS:ffff888427e76000(0000) knlGS:0000000000000000 [ 3487.389529] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3487.389934] CR2: 00007ffcf2d84fd8 CR3: 0000000111d64006 CR4: 0000000000f72ef0 [ 3487.390440] PKRU: 55555554 [ 3487.390641] Call Trace: [ 3487.390826] <TASK> [ 3 ---truncated---
CVE-2026-93137 is a high-severity use-after-free vulnerability in the Linux kernel's BPF subsystem affecting version 5.17. The flaw occurs in the bpf_find_vma() function, which reads the mm_struct of a task without holding a proper reference, allowing a concurrent task exit to free the mm_struct and cause a use-after-free condition. This can lead to memory corruption with potential confidentiality, integrity, and availability impacts.
CVE-2026-93116 is a high-severity vulnerability in the Linux kernel's asus-wmi driver affecting version 5.17. The flaw involves resource leaks during driver initialization due to misordered error handling paths, which skip cleanup of previously allocated resources when certain initialization steps fail. This can lead to resource exhaustion or instability. The issue has been fixed by reordering error path labels to ensure proper cleanup. No known exploits are reported in the wild.
A task_struct reference leak vulnerability was identified and fixed in the Linux kernel's drm/msm driver. The flaw involved a missing put_task_struct() call in the else branch after get_pid_task() increments the task reference count, causing a reference leak during GPU hang recovery. This issue affects Linux kernel version 6.17 and has been resolved in subsequent commits.
CVE-2026-92508 is a high-severity use-after-free vulnerability in the Linux kernel's RDMA core subsystem affecting versions 5.8.17 up to but not including 5.9, 5.9.2 up to but not including 5.10, and exactly 5.10. The flaw occurs in the ib_free_cq() function where the synchronization mechanism is insufficient, allowing a short window where a completion queue (CQ) remains accessible after its resources have been freed. This can lead to memory corruption and potentially allow an attacker with local privileges to cause denial of service or escalate privileges. The issue has been fixed by reordering the call to rdma_restrack_del() to occur before freeing vendor-specific resources, preventing new references to a CQ during its destruction.
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2.
Kiali 2.17.14, for Red Hat OpenShift Service Mesh 3.2, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15402)
* CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15445)
* CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15455)
* CVE-2026-59879 openshift-service-mesh/kiali-ossmc-rhel9: Immutable.js: Denial of Service due to mishandling of large index values in List operations (OSSM-15822)
* CVE-2026-59879 openshift-service-mesh/kiali-rhel9: Immutable.js: Denial of Service due to mishandling of large index values in List operations (OSSM-15824)
* CVE-2026-84375 openshift-service-mesh/kiali-ossmc-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15846)
* CVE-2026-84375 openshift-service-mesh/kiali-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15847)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-92983 is a high-severity vulnerability in InternLM lmdeploy versions up to 0.17.0. The issue occurs in DistServe prefill/decode disaggregation mode where scheduler sessions are not properly released due to the proxy using user-facing session IDs instead of internal scheduler keys. This allows unauthenticated attackers to send completion requests that cause unreleased scheduler metadata and memory accumulation, potentially leading to out-of-memory termination of the prefill worker.
The Migration Toolkit for Containers (MTC) enables you to migrate
Kubernetes resources, persistent volume data, and internal container images
between OpenShift Container Platform clusters, using the MTC web console or
the Kubernetes API.
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.