CVE-2026-119344 is a critical origin validation error in the Cocos AI confidential computing system versions 0.8.2 and earlier. The vulnerability allows a remote attacker controlling another trusted platform to substitute valid attestation Evidence, causing authorization of an incorrect platform. This flaw arises because the system accepts attestation Evidence without binding it to a unique platform owner or enforcing revocation. The issue is addressed in version 0.9.0, but cannot be fully mitigated by source code changes alone due to the underlying confidential computing threat model.
Cluster Observability Operator 1.5 for Red Hat OpenShift provides observability capabilities for cloud-native applications. A security advisory has been issued addressing multiple vulnerabilities including CVE-2026-19534. The advisory references a set of fixes and instructs users to apply updates according to Red Hat's documentation. No specific affected versions are detailed in the advisory. There are no known exploits in the wild for this CVE at the time of publication.
CVE-2026-123125 is a vulnerability in the Symfony Validator component's IpValidator that causes incomplete classification of internal IP addresses in certain filtered modes of the Ip constraint. This flaw allows some internal addresses to be incorrectly accepted as public, potentially enabling Server-Side Request Forgery (SSRF) attacks. The issue affects Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The vulnerability arises because the PHP filter flags used do not cover shared address space or certain IPv6 address types that embed internal IPv4 addresses. Applications relying on this validation to block internal addresses before making server-side requests may be exposed to SSRF.
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0.
CVE-2026-104269 is a high-severity vulnerability in ModSecurity versions 3.0.0 through 3.0.16. The multipart parser in these versions does not correctly apply RFC 2231 precedence rules for the filename* parameter in Content-Disposition headers. This discrepancy allows an attacker to supply a benign filename parameter for ModSecurity inspection while the backend application uses a different encoded filename*, potentially bypassing WAF rules that rely on filename checks. The issue is fixed in version 3.0.17.
ModSecurity versions from 3.0.0 up to but not including 3.0.17 improperly handle case sensitivity when comparing response Content-Type headers against configured SecResponseBodyMimeType entries. This flaw allows a mixed-case response media type, semantically equivalent to a configured lowercase type, to bypass response body inspection. As a result, an unauthenticated attacker can receive response content that would normally be blocked by phase 4 rules, potentially exposing sensitive error or debug information. The issue is resolved in version 3.0.17.
ModSecurity versions prior to 2.9.15 and between 3.0.0 and before 3.0.17 contain an improper certificate validation vulnerability. The HttpsClient::download function sets libcurl's CURLOPT_SSL_VERIFYHOST option to 1 instead of the strict value 2, weakening TLS peer identity verification. This may increase the risk of accepting a certificate for an unintended host under man-in-the-middle or TLS interception scenarios. Exploitation is considered non-trivial in typical environments. The issue is fixed in versions 2.9.15 and 3.0.17.
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
A security update for the python36:3.6 module in Red Hat Enterprise Linux addresses a vulnerability in the pymongo MongoDB Python driver. The flaw, identified as CVE-2026-88029, involves query-operator injection that can lead to data disclosure and denial of service. Red Hat has rated this update as having an important security impact and has released patches for affected versions. The advisory references Red Hat Enterprise Linux 8.4 Extended Life Cycle Long Life and related packages. Users are advised to apply the update as detailed in the Red Hat advisory.
CVE-2026-103932 is a vulnerability in ModSecurity versions from 3.0.5 up to but not including 3.0.17. It involves an incorrect handling of PCRE2 match-limit errors in the @rxGlobal function, which causes certain rules to be bypassed when the SecPcreMatchLimit is exhausted. This can allow requests that should be blocked by the WAF to pass through. The issue is fixed in version 3.0.17.
Content Egg plugin for WordPress versions up to 12.0.0 contains a broken access control vulnerability. This flaw allows unauthenticated attackers to access product data from unpublished posts by exploiting a REST API endpoint that improperly permits requests without a valid nonce. The exposed data includes product titles, affiliate URLs, merchant information, and descriptions from draft, pending, scheduled, or private posts.
An XML External Entity (XXE) injection vulnerability exists in the ContentWorker component of Apache OFBiz 24.09 before 24.09.08 on all platforms. A remote authenticated attacker with content-author permissions can exploit this flaw by submitting crafted XML content containing external entity declarations. This leads to arbitrary file reading on the server and potential server-side request forgery during content rendering. The issue is fixed in version 24.09.08.
Apache OFBiz 24.09 versions prior to 24.09.08 contain an improper authorization vulnerability in the ContentWorker component. This flaw allows a remote unauthenticated attacker to invoke arbitrary OFBiz services with attacker-controlled parameters by exploiting the public showHelpPublic view. The vulnerability enables arbitrary file write, file deletion, and server-side request forgery due to lack of authentication, ownership checks, and parameter validation. Upgrading to version 24.09.08 addresses this issue.
A SQL Injection vulnerability exists in Apache OFBiz 24.09 before 24.09.08 affecting MySQL/MariaDB-backed deployments. It allows remote unauthenticated attackers to disclose arbitrary rows by exploiting the entity engine's generic performFind service with crafted ignore-case find requests. The issue arises because input values are inlined into SQL queries without proper parameter binding, enabling injection via backslash escapes specific to MySQL/MariaDB. The vulnerability does not affect Derby or PostgreSQL datasources. Upgrading to version 24.09.08 resolves the issue.
A Server-Side Request Forgery (SSRF) vulnerability exists in the SurveyWrapper component of Apache OFBiz 24.09 versions prior to 24.09.08. An authenticated back-office user with catalog permission can cause the server to fetch and render arbitrary URLs, including internal network resources and local files, by setting a product-store survey's template location to an attacker-controlled URL. The fetched content is compiled and rendered as a FreeMarker template without validation of the URL scheme or host, leading to non-blind disclosure to any shopper loading the affected survey. Upgrading to version 24.09.08 resolves this issue.
Apache OFBiz 24.09 versions prior to 24.09.08 contain a missing authorization vulnerability in the ProductSearchEvents component. This flaw allows a remote authenticated user with only catalog view permission to perform bulk modifications on product category and feature associations across arbitrary search results. The issue arises because the servlet authorizes requests based solely on view-level permissions, while underlying event methods execute bulk entity modifications without enforcing the necessary DELETE or CREATE permissions. Upgrading to version 24.09.08 addresses this vulnerability.
Apache OFBiz 24.09 versions prior to 24.09.08 contain a missing authorization vulnerability in ProductEvents. This flaw allows a remote authenticated user with only catalog view permission to create, modify, or delete product-related data by invoking certain catalog quick-admin events. The issue arises because the servlet authorizes requests based on view-level permissions, while the underlying event methods perform write operations without verifying update/create permissions. Upgrading to version 24.09.08 resolves this vulnerability.
Apache OFBiz 24.09 versions prior to 24.09.08 contain an incorrect authorization vulnerability in the RequestHandler component. This flaw allows a remote unauthenticated attacker to bypass authentication for protected views by appending the protected view path as a suffix to a public request path. The servlet incorrectly authorizes the request based on the public path component, enabling unauthorized access to protected content. The issue is fixed in version 24.09.08.
Apache OFBiz versions through 24.09.07 contain a vulnerability in the replaceImageToExistImage service that allows remote authenticated attackers with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process. This is due to a path traversal and missing authorization check, which can be exploited by crafting specific parameters. The issue is fixed in version 24.09.08.
A missing authorization check in the getHRChild service of Apache OFBiz versions through 24.09.07 allows remote unauthenticated attackers to recursively enumerate sensitive Human Resources data, including department and position identifiers, employee party identifiers, and organizational relationships. This issue is fixed in version 24.09.08.