Search: 5.1.8.3

This update includes the following RPMs: oauth2-proxy: * oauth2-proxy-7.15.5-0.3.hum1 (aarch64, s390x, x86_64) * oauth2-proxy-7.15.5-0.3.hum1.src (src) Security Fix(es): oauth2-proxy: * CVE-2026-111943

Red Hat OpenShift AI 3.5.2 was released as a security advisory addressing multiple vulnerabilities, including CVE-2024-14029. The advisory announces updated images and provides upgrade instructions but does not detail specific fixes for CVE-2024-14029 or other listed CVEs. No explicit affected versions are stated. The advisory is marked critical in severity but does not confirm known exploitation in the wild.

Multiple vulnerabilities in aiohttp versions from 5.14.0_13 up to but not including 5.14.0_18 can lead to excessive or unbounded memory and CPU usage triggered by attacker-controlled requests. This resource exhaustion can disrupt service availability. A fix is available in version 5.14.0_18.

A vulnerability in ScoutSuite versions >=5.14.0_13 and <5.14.0_18 allows a subdomain to remove the Host-Only flag from an existing cookie set for a parent domain. This could reduce cookie security protections for users accessing untrusted subdomains. The impact is limited because most use cases do not reflect these cookies back to browsers.

AIOHTTP versions from 5.14.0_13 up to but not including 5.14.0_18 contain a vulnerability where an attacker can send an absolute-form HTTP request to spoof the Request.scheme attribute. This can mislead applications relying on this attribute for security decisions, potentially causing them to misinterpret whether a connection is encrypted. The issue is fixed in version 5.14.0_18.

AIOHTTP versions from 5.14.0_13 up to but not including 5.14.0_18 contain a vulnerability where specially crafted multipart requests can exhaust file descriptors. This occurs if a handler uses the Request.post() method, potentially leading to resource exhaustion on the affected system. The issue has been fixed in version 5.14.0_18.

A vulnerability in AIOHTTP's Max-Age processing can cause an overflow that prevents connections from closing properly. This may allow an attacker to temporarily exhaust the connection pool until garbage collection reclaims the connections. The issue affects ScoutSuite versions from 5.14.0_13 up to but not including 5.14.0_18. A fix is available in version 5.14.0_18.

Scoutsuite versions from 5.14.0_13 up to but not including 5.14.0_18 have a vulnerability where the aiohttp server does not enforce an initial request/header timeout. This allows an attacker to keep an idle connection open indefinitely before sending any data, potentially leading to resource exhaustion. A fix is available in version 5.14.0_18. The recommended mitigation is to use a reverse proxy with sensible keepalive limits, which is advised for all production deployments.

A vulnerability in scoutsuite versions >=5.14.0_13 and <5.14.0_18 allows the Secure attribute of shared cookies to not be enforced. This means a cookie marked as Secure could be sent over unencrypted requests, potentially exposing sensitive cookie data.

NLnet Labs Unbound up to and including version 1.26.1 contains a vulnerability identified as CVE-2026-109125. The vulnerability has a medium severity with a CVSS score of 5.3. It involves an observable issue that impacts the integrity of the system but does not affect confidentiality or availability. The affected versions include multiple specific builds primarily related to Ubuntu distributions. No public exploit code or known exploitation in the wild has been reported.

NLnet Labs Unbound versions from 1.22.0 up to and including 1.26.1 contain a vulnerability identified as CVE-2026-97206. This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, and affects multiple Ubuntu package versions. The flaw does not impact confidentiality or integrity but results in a high impact on availability.

CVE-2026-96405 is a medium severity vulnerability affecting NLnet Labs Unbound versions up to and including 1.26.1. The vulnerability relates to limitations in compression handling, causing an availability impact without compromising confidentiality or integrity. No known exploits are reported in the wild. The affected versions include specific Ubuntu package versions of Unbound. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a moderate risk primarily due to potential denial of service.

A vulnerability exists in NLnet Labs Unbound up to and including version 1.26.1, affecting specific Ubuntu package versions. The flaw has a CVSS 3.1 base score of 6.5, indicating medium severity. It does not impact confidentiality but can cause integrity loss and high availability impact. No public exploits or known active exploitation are reported. The exact technical details of the vulnerability are not provided in the available data.

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

CVE-2026-70386 is a high-severity OS command injection vulnerability in OnePlus OxygenOS affecting versions from 15.0.0 before 15.0.0.2000 and from 16.0.0 before 16.0.5.1200. It allows any locally installed Android app, without declared permissions or user interaction beyond launch, to execute arbitrary shell commands as root in a specific SELinux domain. The flaw arises from an unauthorized binder interface accepting event data that is unsafely passed to a system command, leading to privilege escalation.

The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.

This security update for Mozilla Firefox Extended Support Release 153.5.0 ESR addresses multiple vulnerabilities across various components including privilege escalation, sandbox escapes, use-after-free bugs, incorrect boundary conditions, information disclosure, mitigation bypasses, race conditions, integer overflows, spoofing, and denial-of-service issues. Additionally, a use-after-free vulnerability in libexpat is fixed. These issues collectively affect core browser functionality such as networking, graphics, JavaScript engine, DOM, storage, and security sandboxing.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.