Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default and there is no authentication gate protecting the stream CRUD routes. An unauthenticated attacker with network access to TCP/4195 can `POST` a malicious pipeline definition to `/streams/{id}` that includes code-executing processors such as `command`, `subprocess`, `ffi`, or unsafe `sql_raw`, thereby achieving arbitrary RCE on the host with the permissions of the Redpanda Connect service account. Because pipelines can also return command output in-band via HTTP, this vulnerability enables full host compromise, credential theft, and data exfiltration with no user interaction or credentials required.
Starting with v4.111, the API endpoint was reconfigured as opt-in, so this and later versions are no longer vulnerable by default. However, RCE remains achievable on v4.111 and later if the management API is manually enabled via the `--bind-http` flag.
compose-lint versions from 0.22.0 up to but not including 0.32.0 have a vulnerability where secret values from a .env file can be exposed in job logs and code scanning outputs when linting untrusted pull-request content. This occurs because compose-lint substitutes and quotes these secret values in certain finding messages. The issue is fixed in version 0.32.0.
Red Hat JBoss Web Server 6.2.6 includes multiple security fixes addressing vulnerabilities in its components such as Apache Tomcat, mod_cluster, and Tomcat Native library. These vulnerabilities include denial of service, authentication bypass, HTTP/2 request smuggling, TLS issues, and client certificate verification downgrades. The update replaces version 6.2.5 and is rated as having an important security impact by Red Hat.
compose-lint versions from 0.2.0 up to but not including 0.32.0 have a vulnerability where symbolic links to external .compose-lint.yml policy files are followed. If the external file fails YAML parsing, about 30 characters around the parse error position can be leaked in error outputs and GitHub Action logs. This could expose sensitive information such as runner credential file contents. The issue is fixed in version 0.32.0.
compose-lint versions from 0.9.0 up to but not including 0.18.0 contain an off-by-one error in their YAML parser related to handling certain line break characters. This flaw causes the fix --apply command to incorrectly shift edits and delete lines following the targeted line, potentially removing unselected network or security settings. The Compose file remains valid and post-edit checks pass, making the unintended deletion difficult to detect. The issue is resolved in version 0.18.0.
The npm package 'template-projection-map' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee the elimination of all malicious software introduced by it.
The npm package 'template-pictogram' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
The npm package 'template-cards' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee the elimination of all malicious software introduced by this package.
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.
In October 2026, Synology NAS devices running outdated DiskStation Manager (DSM) versions were targeted by C3RB3R ransomware. The ransomware encrypts user files, appending a .L0CK3D extension, and leaves ransom notes demanding payment for decryption. The attack exploits a critical unauthenticated remote code execution vulnerability fixed in December 2024 (likely CVE-2024-10441) and possibly other critical vulnerabilities patched in September 2026. Infection requires only that the NAS be accessible over the internet or local network and not updated. Users are advised to disconnect infected devices from networks and update DSM immediately to mitigate risk.
Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies.
The npm package '@aaron205whitmore/postcss-animate-utils' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, secure machine. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
Tasmota versions up to 16.0.0 have a cross-site request forgery (CSRF) vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protections by crafting malicious Referer headers. This can enable attackers to execute arbitrary console commands and reconfigure device settings if no WebPassword is set. The issue was fixed in commit 1cb7ebc.
compose-lint versions from 0.22.0 up to but not including 0.31.0 contain a path traversal vulnerability. The tool follows symbolic links to .env files and included project directories outside the project scope without proper containment checks. This can lead to exposure of environment data from the linter process, including potentially sensitive information from /proc/self/environ, in logs and alerts. The issue does not affect the pass/fail results of the linter and is fixed in version 0.31.0.
ThorVG versions prior to 1.1.2 contain an out-of-bounds write vulnerability in the bundled jpgd JPEG decoder. This occurs when a crafted grayscale JPEG image includes duplicate component selectors in the SOS scan header, leading to heap buffer overflows during decoding. The flaw can be triggered via direct JPEG decoding or JPEG images embedded in Lottie content. The issue results in memory corruption and process crashes. The vulnerability is fixed in ThorVG version 1.1.2.
During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.
An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.
Exploitable only during the narrow bootstrap window.
Red Hat OpenShift Container Platform 4.14.78 includes security updates addressing two vulnerabilities: CVE-2026-39821, a privilege escalation issue due to incorrect Punycode label processing in golang.org/x/net/idna, and CVE-2026-92092, where the openshift-ansible installer container downloads and executes a remote inventory script without verifying its integrity. Users of OpenShift Container Platform 4.14 are advised to upgrade to these updated packages and images to mitigate these issues.
Red Hat OpenShift Container Platform 4.14.78 includes multiple critical security fixes addressing vulnerabilities such as arbitrary command execution, use-after-free, security bypasses, path traversal, denial of service, and out-of-bounds writes across various components including sg3_utils, OpenSSL, OpenSSH, kernel, brotli, setuptools, and gnutls. Users of OpenShift Container Platform 4.14 are advised to upgrade to this release to mitigate these issues.
OctoPrint versions from 2.0.0rc1 up to but not including 2.0.0rc7 contain a cross-site scripting (XSS) vulnerability in the Serial Connector plugin. Authenticated users can supply crafted default port or baudrate values that are stored and later rendered as HTML, enabling script execution in other users' browsers. This vulnerability is fixed in version 2.0.0rc7.