Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.19.43. See the following advisory for the container images for
this release:
https://access.redhat.com/errata/RHSA-2026:54555
Security Fix(es):
* net: golang: Go net package: Denial of Service via long CNAME response in
LookupCNAME (CVE-2026-33811)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
(CVE-2026-39820)
* net/mail: golang: net/mail: Denial of Service via pathological email
address parsing (CVE-2026-42499)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.19 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. The flaw arises because tokens were missing on many AJAX and state-changing tasks, including contact and quote forms, cart operations, bookmarks, uploads, messages, AI text generation, and several administrator actions. Exploitation requires a valid session: frontend attacks need a registered or listing-owner session, while admin attacks require a backend administrator session. The vulnerability has a medium severity rating with a CVSS score of 4.6.
A vulnerability in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2 allows an attacker to send emails to arbitrary addresses. The recipient address is taken from user-controlled request parameters instead of server-side records, resulting in an open mail relay issue.
A reflected cross-site scripting (XSS) vulnerability exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. The vulnerability arises because the companyName parameter from the request is written unescaped into an XML attribute, allowing improper neutralization of input during web page generation.
A denial-of-service (DoS) vulnerability exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. The issue arises from improper handling of pagination parameters where non-numeric or array values can cause PHP type errors and unvalidated limits in list queries, leading to resource exhaustion.
A critical SQL injection vulnerability (CWE-89) exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. The flaw occurs in the trips search functionality where search keywords and ORDER BY clauses are concatenated directly into SQL queries without proper sanitization. Version 6.2.3 addresses this by quoting keywords and allow-listing the sort clause to prevent injection.
A critical vulnerability (CVE-2026-75949) exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. It allows arbitrary file upload and deletion due to insufficient path containment enforcement and weak file extension checks. Additionally, the upload and removal functions lack CSRF token protection, increasing the risk of unauthorized actions.
An improper access control vulnerability exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. This flaw allows unauthenticated attackers to take over ownership of listings by supplying arbitrary company and user IDs, even for listings that already have an owner. Version 6.2.3 fixes this issue by restricting the action to authenticated users and only permitting ownership changes for unowned listings.
ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the change, enabling tampering with admin-defined function logic. The issue is fixed in 26.8.1. (JavaScript functions still trigger the UPDATE_SECURITY check and are not affected.)
Red Hat build of MicroShift is Red Hat's light-weight Kubernetes
orchestration solution designed for edge device deployments and is built
from the edge capabilities of Red Hat OpenShift Container Platform.
MicroShift is an application that is deployed on top of Red Hat Enterprise
Linux devices at the edge, providing an efficient way to operate
single-node clusters in these low-resource environments.
This advisory contains the RPM packages for Red Hat build of MicroShift
4.19.43. Read the following advisory for the container images for this
release:
https://access.redhat.com/errata/RHSA-2026:54555
Security Fix(es):
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
(CVE-2026-39820)
All Red Hat build of MicroShift 4.19 users are advised to use these updated
packages and images when they are available in the RPM repository.
An unauthenticated arbitrary file upload vulnerability exists in the Zoo extension for Joomla by yootheme.com, versions 1.0.0 through 4.1.63. The vulnerability arises because the image element accepts arbitrary files when the client-supplied Content-Type is within the image MIME group. This can allow attackers to upload dangerous files without authentication.
An open redirect vulnerability (CWE-601) exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.63. The vulnerability occurs in the CommentController::twitterAuthenticate() function where the referer request parameter is passed directly to setRedirect() without validation, allowing redirection to untrusted sites. This issue has a medium severity with a CVSS score of 5.1.
An unauthenticated SQL injection vulnerability exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.63. The flaw occurs in the ItemController::element() method where the filter_type request parameter is directly interpolated into an SQL query without proper quoting or escaping, allowing attackers to manipulate the query structure.
This is a malware campaign involving the Shadow HVNC and Shadow Loader kits, which are noted for robust license protection mechanisms. The campaign is identified by multiple file hashes and an IP address associated with the malware. There is no detailed technical information or evidence of active exploitation in the wild. The campaign's impact relates to potential unauthorized remote access or payload delivery through these malware tools. No patches or vendor advisories are available for remediation.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.18.53. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:54545
Security Fix(es):
* js-yaml: js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs (CVE-2026-46597)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.
CVE-2026-67363 is a high-severity vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.1. It allows unauthenticated attackers to tamper with payment amounts by exploiting the stripeCharges and payAuthorize endpoints, which accept client-controlled charge totals without verification. This flaw enables attackers to purchase items at arbitrary prices, including very low amounts, and to forge line items, quantities, and shipping details. The endpoints lack authentication and CSRF protections, increasing the risk of exploitation.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5)
package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops instead of the npm registry. On `npm install`, npm fetches a tarball from this host over unauthenticated plain HTTP with no integrity hash, and installs its contents into the consumer's node_modules. The domain operator can serve arbitrary, mutable bytes on each fetch, meaning any code shipped from that host runs inside the installer's dependency tree. The main module's header additionally self-identifies the package as a 'Security Research Testing Purpose' artifact, and the package description is a bare 'NPM', consistent with a hijack-vector proof-of-concept rather than a functional utility. The auto-execute condition is satisfied: any default `npm install` of this package resolves and installs the attacker-controlled tarball without user opt-in.
## Source: ghsa-malware (5b1bef8caf5ddc16dd3678dd285bba97e31d6b6ec8844b04c441a430c163f621)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The de-morgan npm package version 2.1.3 declares dependencies pointing to a non-official, HTTP-hosted URL (http://pack.nppacks.com/npm/de-morgan) for its code. This URL is attacker-controlled and mutable, allowing the installed package to execute arbitrary code fetched from this external source during npm install. The package's visible source appears benign but the actual installed code depends on the remote content, posing a risk of malicious code execution.