CVE-2026-96943 is an integer overflow or wraparound vulnerability in the Microsoft Raw Image Extension. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects versions from 2.1.0.0 up to but not including 2.4.36.0. Microsoft has released an official fix in version 2.4.36.0 to address this issue.
This security update for Docker addresses multiple vulnerabilities including an infinite loop in HTTP/2 transport, a validation bypass and privilege escalation via ASCII-only Punycode labels, improper certificate validation allowing authorization bypass, and arbitrary code execution with full daemon privileges through compressed archive uploads. The update also fixes a non-security issue related to SELinux CIL files. Docker has been updated to version 29.7.2 and buildx to 0.36.1.
The Grav API plugin (grav-plugin-api) before version 1.0.36 has a vulnerability where session validation is insufficient. Disabled user accounts can continue to access API endpoints by reusing existing authorized sessions, as the SessionAuthenticator does not check account state. This allows disabled users to bypass operator revocation until their sessions expire.
Grav grav-plugin-api versions before 1.0.36 contain a privilege escalation vulnerability that allows delegated user managers to gain super-admin access. This occurs when positive scalar admin or API parent grants are stored, enabling attackers with api.users.write permission to manipulate account access maps or invitations. This manipulation causes the permission resolver to satisfy requireSuper checks, granting access to super-admin-only API endpoints.
PeproDev Ultimate Profile Solutions WordPress plugin versions up to and including 8.2.36 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user input in the 'button' attribute of the 'logout-url' shortcode. Authenticated users with contributor-level or higher privileges can inject malicious scripts that execute when other users view the affected pages.
The Frontend Admin by DynamiApps WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.28.36. The vulnerability arises from improper input neutralization in the 'get_dynamic_values' function, which performs text-level replacements without HTML-aware parsing. Authenticated users with Contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages. The CVSS 3.1 score is 6.4, indicating a medium severity risk.
## Summary
Nginx-UI v2.4.3 stores the API JWT in a browser cookie named `token` and the `AuthRequired` middleware accepts that cookie as an authentication source. Because management endpoints are protected by `AuthRequired` and do not enforce a universal CSRF token or Origin/Referer check, a remote attacker can induce a logged-in administrator to submit cross-site state-changing requests. The attacker does not need to read the cross-origin response; the browser-sent cookie is enough to authenticate the request.
## Details
The root cause is a trust-boundary failure between browser-managed cookies and API bearer-token authentication. In `app/src/pinia/moudule/user.ts:25-35`, the front end writes the JWT to a `token` cookie when the token changes. In `internal/middleware/middleware.go:16-36`, `getToken` first checks the `Authorization` header and `token` query parameter, then falls back to `c.Cookie("token")`. That fallback causes browser-initiated cross-site requests to carry a valid API credential automatically. The route group in `router/routers.go:87-110` applies `middleware.AuthRequired()` to many management modules, including `config.InitRouter`, `nginx.InitRouter`, `settings.InitRouter`, and backup-related handlers. For accounts without OTP/Passkey, `RequireSecureSession` does not provide a universal second factor for all state-changing operations. A representative sink is `api/config/add.go:68-78`, where an authenticated request writes Nginx configuration with `os.WriteFile` and then calls `nginx.Control(nginx.Reload)`. CORS does not mitigate this issue because preventing cross-origin response reads does not prevent cross-site form or no-cors requests from being sent with cookies.
Core vulnerable code path:
```typescript
// app/src/pinia/moudule/user.ts:25-35
watch(token, v => {
if (v) {
cookies.set('token', v, getCookieOptions(86400))
if (!shortToken.value) {
void fetchShortToken()
}
}
else {
cookies.remove('token', { path: '/' })
shortToken.value = ''
}
})
```
The front end stores the authentication token in a `token` cookie. The cookie is created client-side and is not shown here as HttpOnly; it becomes the credential that the back end later accepts through cookie fallback.
```go
// internal/middleware/middleware.go:16-36
// getToken from header, cookie or query
func getToken(c *gin.Context) (token string) {
if token = c.GetHeader("Authorization"); token != "" {
return
}
if token = c.Query("token"); token != "" {
if len(token) > 16 {
// Long token (base64 encoded JWT)
tokenBytes, _ := base64.StdEncoding.DecodeString(token)
return string(tokenBytes)
}
// Short token (16 characters)
return token
}
if token, _ = c.Cookie("token"); token != "" {
return token
}
return ""
}
```
`getToken` accepts the `token` cookie as an authentication credential after checking the header and query parameter. That behavior lets a browser-sent cookie authenticate state-changing API requests triggered from another origin.
```go
// router/routers.go:87-110
// Authorization required and not websocket request
g := root.Group("/", middleware.AuthRequired(), middleware.Proxy())
{
debug.InitRouter(g)
user.InitUserRouter(g)
analytic.InitRouter(g)
user.InitManageUserRouter(g)
nginx.InitRouter(g)
sites.InitRouter(g)
streams.InitRouter(g)
config.InitRouter(g)
template.InitRouter(g)
certificate.InitCertificateRouter(g)
certificate.InitDNSCredentialRouter(g)
certificate.InitAcmeUserRouter(g)
dnsapi.InitRouter(g)
system.InitPrivateRouter(g)
settings.InitRouter(g)
llm.InitRouter(g)
cluster.InitRouter(g)
notification.InitRouter(g)
external_notify.InitRouter(g)
backup.InitAutoBackupRouter(g)
nginxLog.InitRouter(g)
upstream.InitHTTPRouter(g)
```
Many management modules, including Nginx, configuration, settings, backup, and user management, are placed behind `AuthRequired`. The cookie fallback therefore protects high-impact state-changing routes, not only read-only endpoints.
```go
// api/config/add.go:68-78
err = os.WriteFile(path, []byte(content), 0644)
if err != nil {
cosy.ErrHandler(c, err)
return
}
res := nginx.Control(nginx.Reload)
if res.IsError() {
res.RespError(c)
return
}
```
This representative sink shows why the CSRF is high impact: once authenticated through the cookie fallback, a request can write Nginx configuration content and trigger a reload.
## POC
Prerequisites: an administrator is logged in to Nginx-UI and has a browser `token` cookie; the administrator account has not enabled OTP/Passkey, or the chosen target endpoint does not require secure-session proof; the attacker knows the Nginx-UI management URL and can induce the administrator to visit an attacker-controlled page. Reproduction: (1) Host an attacker page at `GET /csrf.html` that automatically submits a cross-site request to the victim instance. (2) The page submits `POST /api/configs`
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.21.36. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHBA-2026:74378
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/
Security Fix(es):
* kernel: sctp: prevent peer transport count overflow (CVE-2026-74469)
* kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
* kernel: net: tun: bound receive headroom (CVE-2026-81000)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.
A vulnerability in the Linux kernel's wifi libipw driver allows processing of too-short beacon and probe response frames. The libipw_process_probe_response() and libipw_network_init() functions assume a full 36-byte frame prefix, but some receive paths only verify a 24-byte header, causing length miscalculations that lead to out-of-bounds reads. This flaw was identified through AI-assisted code review and verified via testing under Generic KASAN on arm64 in QEMU.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.21.36. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:74378
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
* kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
* kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
Bug Fix(es) and Enhancement(s):
* Backport of protocol attribute to IP addresses (IFA_PROTO) [rhel-9.8.z] (JIRA:RHEL-169936)
* try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [rhel-9.8.z] (JIRA:RHEL-269060)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Dockhand versions before 1.0.36 have an open redirect vulnerability in the OIDC initiation endpoint. This flaw allows unauthenticated attackers to redirect authenticated users to malicious sites by manipulating a redirect query parameter. Exploitation can lead to capturing authorization codes through the Referer header and enable credential phishing attacks targeting Dockhand accounts after legitimate logins. The vulnerability has a medium severity with a CVSS score of 5.3.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 and prior to 5.36 contain a vulnerability where code is downloaded without an integrity check. This flaw could allow an unauthenticated remote attacker to execute code, disclose information, tamper with data, or bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 4.7. No official patch or remediation details are provided in the available data.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 and prior to 5.36 contain an improper certificate validation vulnerability (CWE-295). This flaw allows an unauthenticated attacker with adjacent network access to potentially cause information disclosure, information tampering, and bypass protection mechanisms. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity).
A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.
A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_graph::fetch of the file src/api/resource.rs of the component open_graphic_parse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.