Red Hat Cost Management On-Premise provides cost visibility and analysis for on-premise OpenShift environments. This update includes the latest bug fixes and enhancements.
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
* sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-114267 is a vulnerability in SourceCodester Food Order Management System version 1.0 affecting an admin endpoint. It involves missing authorization controls, allowing remote attackers to perform unauthorized actions. The vulnerability has a medium severity score of 6.9 and public exploit code is available.
Apache Pulsar contains a path traversal vulnerability in its Packages Management Service when using the filesystem storage provider. An authenticated user with package permissions on any namespace can exploit this flaw by manipulating the version component of a package name to access, overwrite, or delete packages in other tenants or namespaces. This can impact the integrity and availability of Pulsar Functions, Sources, or Sinks. The vulnerability affects deployments with package management enabled and the filesystem storage provider configured. It impacts Apache Pulsar versions from 2.10.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5.
Apache Pulsar Manager contains multiple critical authentication flaws that allow unauthenticated users to create administrator accounts, proxy requests with administrative credentials, and gain full control over the management interface. These issues affect versions from 0.1.0 through 0.4.0. The project is no longer maintained, and no fixes will be released. Users are advised to stop using Pulsar Manager, remove deployments, and restrict network access until removal.
CVE-2026-114266 is a SQL injection vulnerability in ProjectWorlds Advanced Library Management System version 1.0. The flaw exists in the mysqli_query function within the profile.php file, where manipulation of the admin_id parameter allows an attacker to inject SQL code. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
Apache Pulsar contains a missing authorization vulnerability in its Pulsar Functions worker REST API. Specifically, the deprecated functions connectors endpoints allow any authenticated user to read the catalog of installed Pulsar IO connectors without requiring super-user access, even when authorization is enabled. This exposure is limited to metadata disclosure of connector type definitions and does not allow modification or management of connectors. The issue affects versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions require super-user access for these endpoints, aligning with the worker connectors endpoint's authorization checks.
CVE-2026-105932 is a missing authorization vulnerability in Apache Pulsar's broker admin REST API for non-persistent topics. The API endpoints for managing topic-level entry filter policies on non-persistent topics do not properly enforce authorization checks, allowing authenticated users with produce or consume permissions—but without policy management rights—to read, modify, or remove these policies. This issue only affects deployments where entry filters are installed and topic-level overrides are enabled, both of which are disabled by default. The vulnerability affects Apache Pulsar versions from 3.3.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5.
CVE-2026-105930 is an authorization vulnerability in Apache Pulsar affecting deployments with authentication, authorization, and package management enabled. It allows an authenticated user with permission to register or update functions, sources, or sinks in their own tenant namespace to access package contents stored in another tenant's namespace without having explicit package permissions there. The issue leads to disclosure of package contents, which may include sensitive application code or credentials, but does not allow modification or deletion of packages or affect service availability. The vulnerability affects Apache Pulsar versions from 2.8.0 before 4.0.14, from 4.1.0 through 4.1.3, and from 4.2.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5 and later.
CVE-2026-114265 is a medium severity SQL injection vulnerability in ProjectWorlds Advanced Library Management System version 1.0. It affects the mysqli_query function in the returned_book_search.php file's Search Form component due to improper handling of the datefrom and dateto parameters. This flaw allows remote attackers to perform SQL injection attacks. Public exploit code exists, but no official patch or remediation guidance is currently available.
CVE-2026-110744 is a vulnerability in the Red Hat Multicluster Global Hub operator where overly broad RBAC permissions allow cluster-wide impersonation of arbitrary users, groups, and service accounts. This flaw enables an attacker who compromises the operator or its service account credentials to escalate privileges and gain full administrative control over the Kubernetes cluster. Exploitation requires initially high privileges to breach the operator deployment or steal credentials. No effective mitigation or patch currently meets Red Hat's criteria for ease of use and stability.
The Simple User Management module for Drupal allows non-administrators to approve, deactivate, and delete users based on delegated roles. However, it insufficiently verifies role delegation when approving users and provides an Activate link for blocked administrators. Additionally, it does not protect the primary user (user 1) from deactivation or deletion. Exploitation requires the attacker to have a role with specific module action permissions.
CVE-2026-114264 is a SQL injection vulnerability in ProjectWorlds Advanced Library Management System version 1.0. The flaw exists in an unspecified function within the edit_member.php file, where manipulation of parameters such as firstname, middlename, lastname, address, branch, or type can lead to SQL injection. The vulnerability allows remote exploitation without user interaction. Public exploit code has been released, increasing the risk of attacks.
CVE-2026-114263 is a SQL injection vulnerability in ProjectWorlds Advanced Library Management System version 1.0. It affects the mysqli_query function in the individual_report_search.php file, specifically via manipulation of the roll_number parameter. The vulnerability allows remote attackers to execute unauthorized SQL commands. Public exploit code is available. The CVSS 4.0 base score is 6.9, indicating medium severity.
CVE-2026-114262 is a vulnerability in the file-management-system affecting the store function in app/Http/Controllers/FileController.php. It allows unrestricted file uploads due to improper handling of the File argument. The vulnerability can be exploited remotely without authentication. The product uses a rolling release model, so specific affected or fixed versions are not available. The issue was reported early but has not yet received a response from the project. Public exploit details have been disclosed.
CVE-2026-114261 is a medium-severity vulnerability in the MomoTommy file-management-system. It affects the Files API component, specifically the index, store, update, and destroy functions in FileController.php. The flaw allows remote attackers to bypass authentication due to improper handling of the Request argument. Exploit code has been publicly disclosed. The product does not use versioning, so affected versions cannot be precisely identified. The vendor has been notified but has not yet responded or issued a fix.
Two critical remote code execution vulnerabilities, collectively known as PHP2Shell, affect PHP versions back to 5.4 and impact widely used web applications such as WordPress, Drupal, and Joomla. These vulnerabilities involve memory management and error handling components of PHP and allow unauthenticated attackers to execute arbitrary code. Exploitation attempts have been detected in the wild shortly after patches were released. The flaws also enable reading sensitive process memory, potentially exposing credentials and secrets. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, 8.2.35, and backports for 7.4, 8.0, and 8.1. The PHP Foundation and security firms urge immediate patching due to the severity and active exploitation attempts.
CVE-2026-114260 is a vulnerability in the oretnom23 file-management-system-php affecting the delete_folder function in ajax.php. It allows remote attackers to bypass authentication by manipulating the ID argument, potentially enabling unauthorized folder deletion. The vulnerability has been publicly disclosed with exploit details available. No specific affected or fixed versions are provided due to the product's continuous delivery model. The vendor has not yet responded or issued a patch.
CVE-2026-114259 is a vulnerability in the oretnom23 file-management-system-php affecting the save_files function in admin_class.php. It allows remote attackers to perform unrestricted file uploads by manipulating the Upload argument. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). The project uses rolling releases, so specific affected and fixed versions are not available. The issue was reported early but has not yet been addressed by the vendor. Exploit code has been published, increasing the risk of exploitation.
CVE-2026-76497 is a medium severity vulnerability in Cisco TelePresence Video Communication Server (VCS) Expressway involving insecure temporary file handling. The issue relates to improper management of temporary files, categorized under CWE-377. Cisco addressed this vulnerability as part of a broader internal security review and software hardening effort. No specific affected versions or patch information is provided in the available data.