A race condition vulnerability in Ruby 4 versions before 4.0.5 allows remote attackers to cause a use-after-free in the pthread-based getaddrinfo timeout handler. This can crash the Ruby process when calling Addrinfo.getaddrinfo with a timeout or Socket.tcp with a resolv_timeout. Exploitation requires delaying DNS responses near the user-specified timeout, potentially via a malicious DNS server or resolver. A patch is available in Ruby 4.0.5.
Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0 have a vulnerability where outdated cached AI-generated summaries can expose removed content to anonymous and unprivileged users who cannot regenerate summaries. This issue has been addressed in the specified fixed versions. A temporary mitigation involves restricting summary generation by tightening allowed groups on summarization Personas.
CVE-2026-7307 is a high severity vulnerability in Red Hat build of Keycloak 26.2.16 where a remote unauthenticated attacker can send specially crafted XML input to the SAML endpoint, causing high CPU usage and worker thread starvation. This results in a Denial of Service (DoS) condition, making the server unavailable. Red Hat has released security advisories and updated packages to address this issue. Users are advised to apply these updates to remediate the vulnerability.
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-7571 is a vulnerability in Red Hat build of Keycloak 26.4 where a low-privilege user can bypass a security control designed to disable the implicit flow in OpenID Connect clients. By manipulating client data during a session restart, the attacker can obtain access tokens that should be unavailable. These tokens may also be exposed in server logs, proxy logs, and HTTP Referrer headers, leading to sensitive information disclosure. The vulnerability has a CVSS score of 7.1, indicating high severity. Red Hat has released updated packages (Keycloak 26.4.12) addressing this and other related security issues. Users are advised to apply these updates after backing up their installations.
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited.
The issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.
CVE-2026-4630 is an authorization bypass vulnerability in Red Hat build of Keycloak 26.4. An authenticated client can exploit an Insecure Direct Object Reference (IDOR) in the Authorization Services Protection API endpoint by using another resource server's UUID within the same realm. This allows unauthorized GET, PUT, and DELETE operations on resources, potentially leading to information disclosure and unauthorized data modification or deletion. Red Hat has released Keycloak 26.4.12 to address this issue. Users should update to this fixed version to remediate the vulnerability.
CVE-2026-37981 is a medium severity vulnerability in Red Hat build of Keycloak 26.4 that involves broken access control in the Account Resources user lookup endpoint. It allows a remote authenticated user who owns at least one User-Managed Access (UMA) resource to enumerate and harvest personally identifiable information (PII) of all users in the realm by sending crafted requests with arbitrary usernames or email values. Red Hat has released an updated package, Keycloak 26.4.12, that addresses this vulnerability along with others. Users are advised to back up their installations and apply the update. No known exploits are reported in the wild at this time.
CVE-2026-37978 is a medium severity vulnerability in Red Hat build of Keycloak 26.4 where a low-privilege administrator with the 'view-clients' role can exploit the 'evaluate-scopes' Admin API endpoint by supplying an arbitrary user ID. This flaw allows unauthorized disclosure of personally identifiable information (PII) across user roles within the realm. The vulnerability can be exploited remotely via network access to the Admin API. Red Hat has released security updates in version 26.4.12 addressing this and other vulnerabilities. Users are advised to apply the update after backing up their installations.
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
A cross-site scripting (XSS) vulnerability exists in GitLab EE versions 18.7 up to but not including 18.9.7, 18.10 up to but not including 18.10.6, and 18.11 up to but not including 18.11.3. This issue occurs in customizable analytics dashboards where improper input sanitization allows an authenticated user to execute arbitrary JavaScript in other users' browsers. The vulnerability has been remediated in later versions.
A cross-site scripting (XSS) vulnerability in GitLab EE versions from 18.7 up to but not including 18.9.7, 18.10 up to but not including 18.10.6, and 18.11 up to but not including 18.11.3 allows an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization. This issue has been remediated in the specified fixed versions.
A cross-site scripting (XSS) vulnerability exists in GitLab EE versions from 16.4 up to but not including 18.9.7, 18.10 up to 18.10.6, and 18.11 up to 18.11.3. This flaw allows an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization. The issue has been remediated in the specified fixed versions.
JupyterLab versions prior to 4.5.7 contain a vulnerability where HTML sanitizer allowlists certain command linker attributes on button elements. This allows a notebook with a pre-saved HTML cell output containing a deceptive button to trigger arbitrary JupyterLab commands, including arbitrary code execution, when clicked by a user. The vulnerability is fixed in version 4.5.7.
JupyterLab versions from 4.0.0 up to but not including 4.5.7 contain a vulnerability in the PyPI Extension Manager that fails to enforce the allow-list of approved extensions. This flaw allows installation of unauthorized third-party extensions from sources outside the default PyPI index. Exploitation could lead to arbitrary code execution and significant system compromise. The issue is fixed in version 4.5.7. Mitigation includes upgrading to 4.5.7 or later and setting the extension manager to read-only mode to prevent unauthorized extension installation.
CVE-2026-6638 is a low-severity SQL injection vulnerability in PostgreSQL affecting logical replication commands. Specifically, the ALTER SUBSCRIPTION ... REFRESH PUBLICATION command allows a subscriber table creator to execute arbitrary SQL using the publication-side credentials. This vulnerability impacts PostgreSQL major versions 16, 17, and 18, but only in minor versions before 16.14, 17.10, and 18.4. Versions prior to 16 are not affected. The attack executes at the next REFRESH PUBLICATION operation. No known exploits are reported in the wild, and no official patch or remediation level has been provided yet.