A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. Successful exploitation could lead to the exposure of client credentials or the redirection of administrative login attempts to malicious sites.
A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.
A security update for webkit2gtk3 on Red Hat Enterprise Linux 9 addresses multiple vulnerabilities in the ANGLE component used by chromium-browser. These include out-of-bounds memory access, heap buffer overflows, use-after-free, integer overflows, type confusion, and insufficient validation of untrusted input. The update is rated as important by Red Hat Product Security and fixes numerous CVEs affecting ANGLE. The vulnerabilities could potentially lead to memory corruption and other security issues.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
* chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
* chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)
* chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
* chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)
* webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
* webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
* webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)
* webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)
* webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
* chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)
* webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)
* webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)
* chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635)
* webkitgtk: Processing maliciously crafted web content may disclose sensitive user information (CVE-2026-64753)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)
* vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)
* vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)
* vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177)
* vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)
* vim: command injection when decompressing .tgz archives (CVE-2026-46483)
* vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162)
* vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858)
* vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167)
* vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
* vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
* vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
* vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This Red Hat Security Advisory addresses multiple vulnerabilities and bugs in the Linux kernel-rt packages for Red Hat Enterprise Linux 8. It fixes security issues including user-triggerable warnings, double-free errors, use-after-free vulnerabilities, and arbitrary code execution via userfaultfd shadow stack manipulation. The update includes fixes for CVE-2026-46117 and CVE-2026-53071, impacting kernel components such as RDMA/mana and Bluetooth l2cap. The update requires a system reboot to take effect.
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.
CVE-2026-75885 is a critical vulnerability in Red Hat OpenShift Container Platform 4.12 affecting the OpenShift console. It allows unauthenticated attackers to access specific API endpoints to send crafted devfile payloads, resulting in Server-Side Request Forgery (SSRF) against internal cluster services. Additionally, attackers can cause unbounded memory growth by sending repeated large requests without a specified content length, leading to denial of service (DoS).
CVE-2026-93574 is a medium severity vulnerability in the Netty netty-codec-http component used by Red Hat Build of Debezium 3.6. It involves incorrect parsing of HTTP/1.1 chunk-size tokens that include post-digit whitespace, leading to HTTP request smuggling. This flaw could allow remote attackers to bypass security controls or access unauthorized resources in proxy or backend deployments. Red Hat has issued a security advisory addressing this and related vulnerabilities in Red Hat build of Quarkus 3.27.5.SP2 with an important security update.
CVE-2026-91203 is a race condition vulnerability in cockpit-files on Red Hat Enterprise Linux 10. It allows a local attacker to exploit a symlink race during privileged file operations, such as changing file ownership or permissions. By winning this timing race, the attacker can redirect these operations to arbitrary files, potentially causing unauthorized changes to file ownership and permissions. This may compromise system integrity and availability by altering system or application states or making services unusable.
A race condition vulnerability exists in the cockpit-files package on Red Hat Enterprise Linux 9 and related distributions. A local unprivileged attacker with write access to a parent directory can replace a newly created directory with a symbolic link before the ownership change is applied, redirecting ownership changes to arbitrary files. This can lead to information disclosure or unauthorized modification of sensitive files such as /etc/shadow. Exploitation requires local access, an attacker-writable parent directory, user interaction, and winning a narrow race window. A fix is being developed for actively maintained releases, while some deferred streams will not receive immediate fixes due to moderate severity and exploitation difficulty. Mitigations include avoiding privileged owner-assignment directory creation in writable directories by untrusted users and applying the sticky bit on shared writable directories.
CVE-2026-92768 is a vulnerability in the cockpit-machines component of Red Hat Enterprise Linux 10 that allows local attackers to expose sensitive VM credentials, including plaintext passwords. This occurs because passwords are passed via command-line arguments during VM creation or installation, making them visible to other local users if process argument visibility is not restricted. Exploitation requires local access and a specific execution window. The vulnerability leads to information disclosure that could compromise VM access.
A vulnerability in the cockpit-machines component of Red Hat Enterprise Linux 10 allows local attackers with process inspection capabilities to view sensitive guest VM credentials. These credentials are passed as JSON command-line arguments during VM creation or installation, making them visible in process listings while the installation workflow is active. The exposure depends on host process-visibility policies and is limited to the installation period.
A local information disclosure vulnerability exists in cockpit-machines on Red Hat Enterprise Linux 10. The flaw exposes a sensitive Red Hat Subscription Management (RHSM) offline token via process command-line arguments during token validation. An attacker with local access and the ability to inspect process metadata can disclose this token, potentially compromising confidentiality. The vulnerability requires low privileges but user interaction and local access. Mitigations include restricting /proc visibility and avoiding token validation on multi-user systems until a fixed package is installed.
A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.
CVE-2026-91142 is a low severity vulnerability in Cockpit on Red Hat Enterprise Linux 10. It involves an integer overflow or wraparound on 32-bit systems when an authenticated local user with a large UID performs session accounting. This flaw can lead to unauthorized modification and disclosure of login records by allowing the user's login process to read or overwrite legacy log entries of other accounts.