FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that crash the process.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section, crashing the process for denial of service.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer, crashing the process.
A vulnerability in MIT Kerberos 5's clnttcp_call() function in Red Hat Enterprise Linux 10 causes a memory leak in GSS-RPC client programs by not freeing the RPC reply verifier between retries. This can be exploited by remote attackers who control an RPC endpoint or intercept client network traffic to cause a denial of service through resource exhaustion. The flaw affects client-side RPC processing only and does not impact authentication servers or default daemon operations. Exploitation requires continuous malformed responses during an active transaction and does not compromise data integrity or confidentiality. Red Hat rates this vulnerability as Moderate and currently has no effective mitigation that meets their criteria.
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
CVE-2026-112320 is a vulnerability in the GSS-RPC transport layer of MIT Kerberos 5 (krb5) 1.4 and later, affecting Red Hat Enterprise Linux 10. It occurs because the system does not release the previous authentication context when a client switches from a GSS authentication flavor to a non-GSS flavor on the same TCP connection. This flaw allows unauthenticated remote attackers to cause a denial of service by exhausting memory in the kadmind service through repeated establishment and abandonment of GSS authentication contexts.
CVE-2026-112319 is a vulnerability in the GSS-RPC layer of MIT Kerberos 5 used in Red Hat Enterprise Linux 10. It allows remote authenticated users to cause a denial of service by triggering unbounded memory allocations during XDR decoding of crafted RPC requests. This leads to memory exhaustion or excessive CPU consumption in the Kerberos administration daemon (kadmind). Exploitation requires valid Kerberos authentication and affects process availability without compromising data confidentiality or integrity.
CVE-2026-112318 is a denial of service vulnerability in the MIT Kerberos 5 kadmind service used in Red Hat Enterprise Linux 10. The flaw occurs because the policy RPC stubs do not reject a NULL policy name, leading to a NULL pointer dereference and crash of the kadmind daemon when a remote authenticated user sends a crafted policy request with an empty policy name. This disrupts administrative operations but does not affect standard ticket-granting or authentication services.
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
CVE-2026-112317 is a vulnerability in MIT Kerberos 5 (krb5) versions 1.2.8 and later, affecting Red Hat Enterprise Linux 10. The flaw occurs in the krb5_ktkdb_get_entry() function, which fails to free decrypted key material when a post-decryption check fails. This leads to a memory leak in the Key Distribution Center (KDC) or kadmind services, allowing unauthenticated remote attackers to cause a denial of service by exhausting service memory through repeated malformed requests.
CVE-2026-112315 is a vulnerability in the RPCSEC_GSS authentication routines of MIT Kerberos 5 used in Red Hat Enterprise Linux 10. It causes a memory leak in the kadmind service due to failure to free partially decoded buffers on error. This can be exploited remotely by unauthenticated attackers sending crafted RPCSEC_GSS messages, leading to denial of service by resource exhaustion. The impact is limited to environments where Kerberos administrative RPC interfaces are exposed to untrusted networks.
CVE-2026-12977 is a vulnerability in Red Hat Fuse 7 involving the WildFly Core deployment-operation handlers. The flaw allows an administrator with the restricted "Maintainer" role to bypass role-based access control (RBAC) and read sensitive configuration files. This can lead to credential exfiltration and full administrative (SuperUser) control of the server, enabling actions such as deploying malicious code or altering audit logs. No official fix or mitigation meeting Red Hat's criteria is currently available.
A malicious file identified by the SHA-256 hash 8f4ebfb87e11d0829e458ddc0f795fc2f1800dd16c7f705cf05fbd95b7bceab9 was observed twice on November 9, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and is linked to attacker infrastructure in Finland. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.
A race condition vulnerability (CWE-362) exists in SuperTokens Core authentication server versions from 7.0.0 up to various fixed versions below 12.3.1. The flaw allows a user controlling a linked login method to retain a signed, refreshable session as the former primary identity after unlinking that login method. This session persists until expiry or explicit revocation. The issue is fixed in multiple versions starting from 11.0.9 through 12.3.1.
fastapi-code-generator version 0.8.0 contains a critical remote code execution vulnerability (CVE-2026-63470) due to improper escaping of the operation summary field when generating route handler docstrings. An attacker can inject triple quotes in the summary to break out of the docstring and execute arbitrary Python code when the endpoint is called. This allows code execution on the server at call time. The issue is fixed in version 0.8.1 by properly escaping triple quotes in the summary before embedding it in the docstring.
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
A path traversal vulnerability exists in the org.zeroturnaround:zt-zip library's fluent API unpack method (CVE-2026-63436). The Zips fluent API does not properly validate ZIP entry paths, allowing entries with '../' sequences to write files outside the intended extraction directory. This can lead to arbitrary file writes outside the target directory when unpacking attacker-controlled ZIP files. The issue affects versions prior to 1.18.0 and is fixed in version 1.18.0.
NASA JPL ION-DTN versions 2.2.1b through 4.2.0 contain an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer. This flaw allows attackers to corrupt heap memory by sending a specially crafted 64-bit svcDataLength value that causes a 32-bit allocation size calculation to wrap around. Exploitation involves triggering an unchecked memcpy operation in the dgr_receive API, potentially leading to out-of-bounds memory writes. The impact includes denial of service or possible remote code execution.