CVE-2026-112317 is a vulnerability in MIT Kerberos 5 (krb5) versions 1.2.8 and later, affecting Red Hat Enterprise Linux 10. The flaw occurs in the krb5_ktkdb_get_entry() function, which fails to free decrypted key material when a post-decryption check fails. This leads to a memory leak in the Key Distribution Center (KDC) or kadmind services, allowing unauthenticated remote attackers to cause a denial of service by exhausting service memory through repeated malformed requests.
CVE-2026-112315 is a vulnerability in the RPCSEC_GSS authentication routines of MIT Kerberos 5 used in Red Hat Enterprise Linux 10. It causes a memory leak in the kadmind service due to failure to free partially decoded buffers on error. This can be exploited remotely by unauthenticated attackers sending crafted RPCSEC_GSS messages, leading to denial of service by resource exhaustion. The impact is limited to environments where Kerberos administrative RPC interfaces are exposed to untrusted networks.
CVE-2026-12977 is a vulnerability in Red Hat Fuse 7 involving the WildFly Core deployment-operation handlers. The flaw allows an administrator with the restricted "Maintainer" role to bypass role-based access control (RBAC) and read sensitive configuration files. This can lead to credential exfiltration and full administrative (SuperUser) control of the server, enabling actions such as deploying malicious code or altering audit logs. No official fix or mitigation meeting Red Hat's criteria is currently available.
A malicious file identified by the SHA-256 hash 8f4ebfb87e11d0829e458ddc0f795fc2f1800dd16c7f705cf05fbd95b7bceab9 was observed twice on November 9, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and is linked to attacker infrastructure in Finland. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.
A race condition vulnerability (CWE-362) exists in SuperTokens Core authentication server versions from 7.0.0 up to various fixed versions below 12.3.1. The flaw allows a user controlling a linked login method to retain a signed, refreshable session as the former primary identity after unlinking that login method. This session persists until expiry or explicit revocation. The issue is fixed in multiple versions starting from 11.0.9 through 12.3.1.
fastapi-code-generator version 0.8.0 contains a critical remote code execution vulnerability (CVE-2026-63470) due to improper escaping of the operation summary field when generating route handler docstrings. An attacker can inject triple quotes in the summary to break out of the docstring and execute arbitrary Python code when the endpoint is called. This allows code execution on the server at call time. The issue is fixed in version 0.8.1 by properly escaping triple quotes in the summary before embedding it in the docstring.
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
A path traversal vulnerability exists in the org.zeroturnaround:zt-zip library's fluent API unpack method (CVE-2026-63436). The Zips fluent API does not properly validate ZIP entry paths, allowing entries with '../' sequences to write files outside the intended extraction directory. This can lead to arbitrary file writes outside the target directory when unpacking attacker-controlled ZIP files. The issue affects versions prior to 1.18.0 and is fixed in version 1.18.0.
NASA JPL ION-DTN versions 2.2.1b through 4.2.0 contain an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer. This flaw allows attackers to corrupt heap memory by sending a specially crafted 64-bit svcDataLength value that causes a 32-bit allocation size calculation to wrap around. Exploitation involves triggering an unchecked memcpy operation in the dgr_receive API, potentially leading to out-of-bounds memory writes. The impact includes denial of service or possible remote code execution.
CVE-2026-119079 is a denial of service vulnerability in the MIT Kerberos 5 implementation used by Red Hat Enterprise Linux 10. The flaw occurs in the decode_sequence_of() function, which inefficiently grows an array one element at a time when decoding certain ASN.1 sequences. Remote attackers can exploit this by sending unauthenticated AS-REQ or TGS-REQ messages with large SEQUENCE OF fields over TCP, causing excessive CPU consumption in the Kerberos Key Distribution Center (KDC) daemon. This vulnerability does not allow data disclosure or code execution but can degrade KDC availability. Mitigation involves restricting TCP port 88 access to trusted networks using firewall rules.
CVE-2026-112323 is a denial of service vulnerability in the AUTH_GSSAPI handler of MIT Kerberos 5 (krb5) versions 1.5.2 and later. Remote attackers can cause memory exhaustion in the kadmind service by sending repeated failed AUTH_GSSAPI_INIT requests, which allocate client state that is only freed after a 15-minute timeout. This allows attackers to accumulate memory faster than it is reclaimed, potentially causing service disruption. The kadmind service is not enabled by default on standard Red Hat Enterprise Linux installations and is typically confined to Kerberos Key Distribution Center environments.
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon (amsd) that allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS (MAMS) configuration management messages that are processed without cryptographic authentication. Attackers can exploit the insufficient buffer size calculation for the internal state-event object to crash the active Configuration Server thread, causing a denial of service and potentially destabilizing subsequent shared-memory allocations in amsd.
NASA JPL ION-DTN versions 3.6.2 through 4.2.0 contain a heap-based buffer overflow vulnerability in the Network Management daemon (nm_mgr). This flaw arises from unsafe string-formatting logic using unbounded strcat operations on deeply nested AMP payloads, allowing out-of-bounds writes. Exploitation can cause nm_mgr to crash, resulting in denial of service that halts telemetry collection and operator visibility.
A vulnerability in ansible-core's ansible.builtin.git module allows argument injection via repository URLs starting with a dash. This flaw occurs because the module invokes git commands without a '--' separator before the repository URL, causing git to interpret dash-leading URLs as command-line options. An attacker controlling the repository URL can exploit this to execute arbitrary commands on the host running the module.
A path traversal vulnerability exists in the Android implementation of the Flutter/Dart receive_sharing_intent package versions 1.4.1 through 1.9.0. This flaw allows a malicious co-resident app to write files outside the intended cache directory by supplying a crafted _display_name value from an untrusted ContentProvider. Exploitation enables file overwrite within the receiving application's private sandbox without user interaction.
During the Agent-Based Installation (ABI) bootstrap of OpenShift, the bootstrap node's approve-csr.service automatically approves and signs all Certificate Signing Requests (CSRs) without validating their identity. This allows an attacker with network access during the brief bootstrap window to retrieve an unauthenticated Ignition file, extract a limited kubeconfig, submit a CSR for the system:admin identity, and obtain a signed certificate granting full cluster-admin privileges.
A vulnerability in the rrule validation logic of the automation controller component in Red Hat Ansible Automation Platform allows an authenticated user to cause a denial of service. The issue arises from inefficient regular expressions that cause validation time to grow quadratically when expected tokens are missing. This can exhaust API web workers, denying access to the API and web UI. The impact is limited to availability with no confidentiality or integrity effects.
A reflected Cross-site Scripting (XSS) vulnerability exists in VideoWhisper.com Broadcast Live Video plugin versions up to 7.3.14. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1.
A stored cross-site scripting (XSS) vulnerability exists in Crocoblock JetFormBuilder versions up to 3.6.8. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of affected users.