Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.15.68. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:56912
Security Fix(es):
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat build of MicroShift is Red Hat's light-weight Kubernetes
orchestration solution designed for edge device deployments and is built
from the edge capabilities of Red Hat OpenShift Container Platform.
MicroShift is an application that is deployed on top of Red Hat Enterprise
Linux devices at the edge, providing an efficient way to operate
single-node clusters in these low-resource environments.
This advisory contains the RPM packages for Red Hat build of MicroShift
4.16.69. Read the following advisory for the container images for this
release:
https://access.redhat.com/errata/RHSA-2026:56854
Security Fix(es):
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of
Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
(CVE-2026-39820)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege
escalation via incorrect Punycode label processing (CVE-2026-39821)
* net/mail: golang: net/mail: Denial of Service via pathological email
address parsing (CVE-2026-42499)
All Red Hat build of MicroShift 4.16 users are advised to use these updated
packages and images when they are available in the RPM repository.
In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:
A user reports unexpected URL wrapping in emails from their CEO, where links are rewritten to a domain 'linkprotect.cudasvc.com'. The organization is not a Barracuda customer and does not use Barracuda add-ons, yet the wrapped links have appeared since late 2025 and recently caused email delivery issues with a client using Proofpoint email filtering. The cause of the wrapping and the sudden failure of these links is unclear.
CVE-2026-55532 is an origin validation vulnerability in MervinPraison PraisonAI prior to version 4.6.58. The issue arises because the HTTP stream origin validation uses a startswith check, allowing attacker-controlled origins like localhost.attacker.com to bypass the localhost allowlist. This enables a webpage to send text/plain requests without preflight and invoke certain API calls without an API key, including file writes that can persist agent instructions. The vulnerability is fixed in version 4.6.58.
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
CVE-2026-77997 is a medium severity vulnerability in the YOOtheme Pro extension for Joomla versions 1.0.0 through 5.0.41. It involves improper access control where users with com_template editing permissions can access information about arbitrary modules without having the necessary com_modules permissions. This could lead to unauthorized disclosure of privileged information.
CVE-2026-77996 is a high-severity stored cross-site scripting (XSS) vulnerability in the YOOtheme Pro extension for Joomla. It affects versions 1.0.0 through 5.0.41. The flaw arises from improper escaping of input in the location custom field, allowing authenticated privileged users to inject malicious scripts. This vulnerability does not require user interaction and has a high impact on confidentiality and integrity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.21.30. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:57801
Security Fix(es):
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.11. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:57361
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.21.30. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:57456
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.21.30. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:57801
Security Fix(es):
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.
The npm package 'css-import-order' version 1.1.0 declares its own name as a dependency and devDependency pointing to an untrusted, non-registry HTTP URL (http://pack.nppacks.com/npm/css-import-order). This allows npm install to fetch and execute potentially attacker-controlled code during installation, bypassing integrity checks and version pinning. The local module code is benign, but the installation process is the attack vector.