Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.
Red Hat Satellite 6.17.11 update addresses multiple security vulnerabilities in components including jackson-databind, jackson-core, AIOHTTP, ruby-jwt, Eclipse Jetty, and ansible-core. These vulnerabilities enable arbitrary code execution, denial of service, authentication bypass, HTTP request smuggling, and information disclosure. The update fixes these issues for Red Hat Satellite versions from 6.17.0 up to but not including 6.17.11. Several bugs related to upgrade and migration are also resolved.
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke
`java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
CVE-2026-84964 is a high-severity double free vulnerability in the MongoDB C Driver affecting versions 1.17.0 up to but not including 1.30.9, and 2.0.0 up to but not including 2.5.2. It occurs in the OpenSSL-based TLS certificate revocation checking path during the TLS handshake when specially crafted certificate data causes the same heap object to be freed twice. This can lead to unexpected termination of the client application. The vulnerability can be triggered by an unauthenticated party acting as a trusted TLS endpoint.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.17.57. See the following advisory for the container images for
this release:
https://access.redhat.com/errata/RHSA-2026:60023
Security Fix(es):
* net/url: Incorrect parsing of IPv6 host literals in net/url
(CVE-2026-25679)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in
certificate chain building (CVE-2026-32280)
* net: golang: Go net package: Denial of Service via long CNAME response in
LookupCNAME (CVE-2026-33811)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
(CVE-2026-39820)
* net/mail: golang: net/mail: Denial of Service via pathological email
address parsing (CVE-2026-42499)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME
header (CVE-2026-42504)
* crypto/tls: crypto/tls: Incorrect certificate validation during TLS
session resumption (CVE-2025-68121)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.17 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat OpenShift Container Platform 4.17.57 includes multiple security fixes addressing vulnerabilities in components such as the kernel, samba, gnutls, vim, sssd, glibc, systemd, and others. These fixes mitigate issues including privilege escalation, denial of service, remote code execution, information disclosure, authentication bypass, and buffer overflows. Users of OpenShift Container Platform 4.17 are advised to upgrade to this release to apply the security updates.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.57. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:60018
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.17.57. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:60023
Security Fix(es):
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs (CVE-2026-46597)
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
* js-yaml: js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
Submariner v0.24 is a Kubernetes operator enabling cross-cluster connectivity for services and pods. Red Hat released security fixes and updated container images addressing multiple vulnerabilities in this release. The update is rated as having an important security impact. The advisory references several CVEs including CVE-2026-27136 and others, with fixes incorporated in Red Hat Advanced Cluster Management for Kubernetes 2.17. The vendor provides updated images and documentation for remediation.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-570.17.1.el9_6.
Security Fix(es):
* kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
* kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)
* kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a privileged service, leading to elevated code execution. Exploitation required pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository containing a configured pre-receive hook. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.
A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp, not the request path or body. An attacker positioned to intercept the outbound request could capture this token and replay it against privileged management agent endpoints. High-availability deployments were not affected due to a topology restriction. This vulnerability affected GitHub Enterprise Server releases in the 3.17, 3.18, 3.19, 3.20, and 3.21 series and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. This vulnerability was reported via the GitHub Bug Bounty program.
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that attributeName selecting href or xlink:href gives the sibling values, from, to, or by attribute SVG SMIL URL semantics. In configurations that allow the animate, animateColor, animateMotion, animateTransform, or set elements, a values list can begin with a safe fragment and contain a later executable destination that survives allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that later destination into the live link, and a victim who activates the link can execute script in the application's origin. This issue is fixed in version 2.17.7.
A vulnerability in Erlang/OTP inets httpd allows remote unauthenticated attackers to bypass authentication and read files inside mod_auth protected directories on case-insensitive filesystems by exploiting improper handling of case sensitivity in request paths. This affects multiple versions of Erlang/OTP from 17.0 up to but not including patched versions 27.3.4.17, 28.5.0.6, and 29.0.6. The issue arises because the authentication check does not consider case-insensitive matches, while the filesystem resolves paths case-insensitively, allowing unauthorized access. A fix is available and has been released by Ubuntu in security updates.