Red Hat has issued a security advisory for the opentelemetry-collector component in Red Hat Enterprise Linux 9.8 Extended Update Support. The update addresses multiple denial of service vulnerabilities in various Go language packages used by the collector, as well as a man-in-the-middle vulnerability involving untrusted intermediate certificates. The vulnerabilities include crafted HTTP Range headers, excessive HTTP/2 SETTINGS frames, memory limit bypass in multipart form parsing, multiple ECH outer extension references, and untrusted intermediate certificates. These issues could allow denial of service attacks or man-in-the-middle attacks if exploited.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a path traversal vulnerability (CWE-22) that allows a high privileged attacker with adjacent network access to potentially access the filesystem. This vulnerability is fixed in version 4.8.0 and later.
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation.
This issue affects eta-register: from 2.0.8 before 2.0.9.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving incorrect permission assignment for a critical resource. This flaw allows a low privileged local attacker to bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 5.5. A fix is available in version 4.8.0 and later.
This analysis covers a Horus Loader 64-bit Windows loader sample linked to the Stealth Falcon campaign and CVE-2025-33053. The loader employs techniques such as IP obfuscation, WebDAV execution, and integrates with the Mythic command and control (C2) framework. It performs clean kernel32/ntdll mapping, security process checks, IPv6 payload reconstruction, and injection into suspended msedge.exe processes.
Dell OpenManage Enterprise versions prior to 4.8.0 have an improper verification of cryptographic signatures vulnerability (CWE-347). This flaw allows a high privileged local attacker to potentially gain unauthorized filesystem access. The vulnerability has a CVSS 3.1 score of 6.4, indicating a medium severity. A fix is available starting from version 4.8.0.
A bug fix and enhancement update for the Red Hat Real Time Linux Kernel addresses an assertion failure in the gfs2_glock_hold() function on RHEL-8 systems.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Multiple security vulnerabilities have been identified in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. These include arbitrary code execution due to missing symlink protection, arbitrary write access as root via extra-data extraction, a buffer overflow in OCI delta stream path names on 32-bit systems, and local privilege escalation via symlink traversal in the revokefs writer. Red Hat has issued an important security update addressing these issues for Red Hat Enterprise Linux 10.0 Extended Update Support and related products.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.
CVE-2026-118871 is an SQL injection vulnerability that allows attackers with login access to steal database information. The vulnerability is classified with a medium severity score of 6.5 and requires low privileges to exploit. No public exploits or patches are currently documented.
This vulnerability involves the logging of irrelevant properties by an Event Publisher output adapter, which can include sensitive user credentials or confidential information if misconfigured. An attacker with access to the 'wso2carbon' log files could extract this sensitive data, potentially leading to unauthorized access. The issue is due to improper handling of configuration properties in logging.
CVE-2025-13647 is a vulnerability where the affected component does not properly validate the content-type header in certain requests. This flaw allows attackers to craft requests with manipulated content-type headers, leading to unintended exposure of file paths for certificate files. The information disclosure could aid attackers in further compromising system confidentiality. The vulnerability has a medium severity with a CVSS score of 5.8.
CVE-2024-9517 is a vulnerability in WSO2 products where the refresh token grant type does not re-validate the account status before issuing new access tokens. This flaw allows attackers to obtain valid access tokens for accounts that have been blocked, bypassing account lockout protections. The vulnerability can lead to unauthorized access and potential privilege escalation or data exfiltration depending on the compromised account's permissions.
ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 have a vulnerability that allows authenticated users to execute remote code via the Log Forward option. This vulnerability has a high severity score of 8.7 and requires high privileges to exploit, with no user interaction needed.
CVE-2025-12544 is a vulnerability in the Publisher portal where insufficient validation of uploaded SVG files allows users with the Publisher role to inject malicious scripts. Exploitation involves uploading crafted SVG files that are stored and rendered by the application, enabling actions such as browser redirection, UI modification, or information retrieval. The impact is limited by httpOnly flags on session cookies, preventing session hijacking.
CVE-2026-2613 is a high-severity vulnerability in the Admin REST API where user input is not properly sanitized, allowing an administrator to perform blind SQL injection. This can lead to unauthorized inference of database information and potentially disrupt database availability.
CVE-2024-2372 is an open redirection vulnerability where affected components accept user input for redirection URLs without proper validation. This flaw allows attackers to craft URLs that redirect users to arbitrary external domains, facilitating phishing attacks through social engineering.
An integer overflow vulnerability exists in the Qt XML parsing functionality, specifically within Qt5Compat / QXmlSimpleReader. This flaw could potentially be exploited under certain conditions, but no known exploits are reported in the wild. The vulnerability has a medium severity rating with a CVSS score of 5.8.
CVE-2024-7075 is a cross-site scripting (XSS) vulnerability in the user search function of a management console. The function does not properly encode user input before rendering it in the browser, allowing attackers to inject malicious scripts. Exploitation can lead to browser redirection, UI manipulation, or information disclosure from the browser. The vulnerability does not allow session hijacking due to the httpOnly flag on session cookies.