CVE-2026-79809 is a high-severity unauthenticated path traversal vulnerability in an API endpoint of Hewlett Packard Enterprise's ClearPass Policy Manager (CPPM). Exploitation allows a remote attacker without authentication to influence authorization decisions and be assigned unintended roles. The vulnerability affects versions 6.11.0 through 6.11.15 and version 6.14.0. The CVSS 3.1 score is 7.3, indicating a significant risk with network attack vector, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.
CVE-2026-79808 is a buffer overflow vulnerability in the OnGuard agent of Hewlett Packard Enterprise's ClearPass Policy Manager (CPPM). An authenticated local user could exploit this flaw to execute arbitrary code with elevated privileges or disrupt the service availability. The vulnerability affects specific versions 6.11.0 through 6.11.15 and version 6.14.0. It has a high severity rating with a CVSS score of 7.8. No information about available patches or exploits in the wild is provided.
CVE-2026-79805 is a critical authenticated path traversal vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). Exploitation allows an attacker to read and modify certain files on the underlying operating system. The vulnerability affects versions 6.11.0 through 6.11.15 and version 6.14.0. It has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch links or vendor advisories are provided, and no known exploits are reported in the wild.
CVE-2026-79803 is a command injection vulnerability in the API of Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). An authenticated remote attacker could exploit this flaw to escalate privileges and gain administrative control over the affected system. The vulnerability has a high severity with a CVSS score of 8.8. It affects specific versions of CPPM including 6.11.0 through 6.11.15 and version 6.14.0. No information about available patches or vendor advisories is provided.
CVE-2026-79802 is a command injection vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager client software. An attacker supplying crafted input could execute arbitrary commands with elevated privileges on the affected host. The vulnerability has a high severity with a CVSS score of 8.8. It affects specific versions of ClearPass Policy Manager, including 6.11.0 through 6.11.15 and version 6.14.0. No patch or remediation information is provided in the available data.
A critical vulnerability (CVE-2026-79796) exists in Hewlett Packard Enterprise ClearPass Policy Manager (CPPM) that allows an unauthenticated remote attacker to bypass authentication controls. Exploiting this flaw could grant unauthorized access to the affected system, impacting confidentiality, integrity, and availability. The vulnerability affects specific versions of CPPM including 6.11.0 through 6.11.15 and version 6.14.0. The CVSS score is 9.8, indicating a high severity risk. No patch or remediation details are provided in the available data.
CVE-2026-76754 is a critical SQL injection vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). It allows an unauthenticated remote attacker to execute arbitrary database commands via a vulnerable interface. The affected versions are 6.11.0 through 6.11.15 and version 6.14.0. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-76750 is a critical deserialization vulnerability in the web interface of Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). It allows an unauthenticated remote attacker to execute arbitrary code on the affected system. The vulnerability affects specific versions of CPPM, including 6.11.0 through 6.11.15 and version 6.14.0. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges required, and no user interaction needed.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
Red Hat Single Sign-On is an integrated sign-on solution, available as a
Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat
Single Sign-On for OpenShift image provides an authentication server that
you can use to log in centrally, log out, and register. You can also manage
user accounts for web applications, mobile applications, and RESTful web
services.
This erratum releases a new image for Red Hat Single Sign-On 7.6.13 for
use within the OpenShift Container Platform 3.10, OpenShift Container Platform
3.11, and within the OpenShift Container Platform 4.3 cloud computing
Platform-as-a-Service (PaaS) for on-premise or private cloud deployments,
aligning with the standalone product release. This security update has moderate
impact.
Security fixes:
* undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)
* Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543)
* Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543)
* Information disclosure and data deletion via second-order SQL injection (CVE-2026-0603)
* GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
* unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
* High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)
* HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)
* HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)
* Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
* Denial of Service via malformed HAProxy message (CVE-2026-44893)
* Denial of Service due to resource leak (CVE-2026-48043)
* Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)
* Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
* Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
* Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
* Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
* Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
* Denial of Service via deeply nested JSON processing (CVE-2026-50193)
* Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
* Missing authentication on EAP's IIOP NameService leads to MITM or DoS (CVE-2026-15563)
* Session fixation in OIDC login flow that can lead to account takeover (CVE-2026-7507)
* Denial of Service via specially crafted SAML input (CVE-2026-7307)
* Denial of Service due to excessive SAMLRequest decompression (CVE-2026-2575)
* Denial of Service via excessive processing of OpenID Connect scope parameters (CVE-2026-4634)
* Unauthorized access via improper validation of encrypted SAML assertions (CVE-2026-2092)
This package is part of a large family (100+ identified as of September 2026) of near-identical
forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into
the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW
query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter
JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the
victim's account to channels it never asked to join.
The target JID(s) are hidden from casual source review via one of several obfuscation techniques
observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code
array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote
JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change
after installation without a new npm publish. Every sample in the family shares the same underlying
mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after
connect), even though the package name, JID value(s), and obfuscation/delivery method differ per
fork.
The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and
subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish
persistence, or execute arbitrary remote code.
Affected package: @bottino/baileys (npm), version(s): 1.0.14, 1.0.13, 1.0.12, 1.0.11, 1.0.10, 1.0.9, 1.0.8, 1.0.7, 1.0.6, 1.0.5, 1.0.2, 1.0.1.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (571d52cf3274d95d4824667269921b2e0ad1478fe9f324a74fab0ba377bb9a26)
This fork of Baileys overrides `requestPairingCode` so that when the caller does not supply an explicit `pairKey`, `authState.creds.pairingCode` is set to the fixed literal string `BYPAKI64`. That value is then used as the KDF input for the WhatsApp companion-device link-code encryption via `derivePairingCodeKey(authState.creds.pairingCode, salt)`. Because the pairing code is a known constant baked into the package, anyone who knows the target phone number of the installer's WhatsApp account can complete the companion-device pair flow from a device they control and obtain persistent access to the installer's WhatsApp session (read/send messages, contacts, media) — a full account takeover backdoor against any application built on this library. Additionally, on socket connect the code auto-subscribes the installer's WhatsApp account to a hardcoded newsletter JID `120363418582531215@newsletter` and persists a `basedbysam` flag so the covert subscribe runs once per credential store; this covert action uses the installer's WhatsApp identity without disclosure.
Weblate versions from 4.11.1 up to but not including 2026.8 contain an OS command injection vulnerability in the Mercurial backend. This flaw allows an authenticated user with project-scoped component.edit permission to exploit repository filenames starting with a dash (-) as Mercurial options, potentially leading to arbitrary command execution with the Weblate service account privileges. This vulnerability is a residual issue from an incomplete fix for CVE-2022-23915 and has been addressed in version 2026.8.
### Impact
Morgan writes attacker-controlled request data to the access log. Its escaping (added in 1.11.0 and 1.12.0) neutralizes control characters, the Unicode line separators, and backslash, but not the double quote (`0x22`), which is the field delimiter of the Apache combined log format morgan emits. An attacker who controls a quoted field (`:user-agent`, `:referrer`, the request URL, or the Basic auth `:remote-user`) can inject a double quote to close the field early and forge additional fields in the log record. The `combined`, `common`, and `default` formats, and any custom format that quotes a token, are affected. This is an incomplete fix of CVE-2026-5078 and CVE-2026-15603.
### Patches
Users should upgrade to version 1.12.1.
### Workarounds
Update to version 1.12.1.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.
CVE-2026-88808 is a high-severity vulnerability in SUSE Rancher Fleet where the Fleet agent improperly uses cluster-admin credentials instead of the intended ServiceAccount credentials when writing resources to downstream clusters. This affects multi-tenant environments sharing downstream clusters, potentially allowing unauthorized overwriting of configuration files. The issue impacts SUSE Rancher Fleet versions 0.14 before 0.14.11, 0.15 before 0.15.7, and 0.16 before 0.16.2.
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.
This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.
This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal.
This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.
CVE-2026-66071 is a medium severity vulnerability in RabbitMQ server versions from 3.13.0 up to 3.13.15 and several 4.x versions. It involves atom exhaustion caused by parsing OAuth2 JWT scope values influenced by users in certain IdP configurations. The vulnerability allows leaking of atom tags during login with novel scope values. This issue is fixed in RabbitMQ versions 3.13.15, 4.0.22, 4.1.11, 4.2.6, and 4.3.1.