This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel 4.18.0-477.107.1.el8_8 via live patch modules. The fixes include limiting IPC next_id allocation to valid ID ranges (CVE-2026-52923), correcting a potential use-after-free in UDP tunnel segmentation (CVE-2026-74705), and bounding receive headroom in the tun network driver (CVE-2026-81000). These patches are delivered as kpatch live patch modules for Red Hat Enterprise Linux 8.8. The advisory rates the update as important and provides links for applying the updates.
A Red Hat security advisory addresses multiple vulnerabilities in Mozilla Thunderbird and Firefox components, including denial of service, privilege escalation, information disclosure, use-after-free, sandbox escapes, mitigation bypasses, and other security issues. These vulnerabilities affect various components such as XML parsing, application update, DOM, JavaScript engine, networking, graphics, and security policies. The advisory provides an update for Thunderbird on Red Hat Enterprise Linux 9.6 Extended Update Support to fix these issues.
ARTEX is an AI-powered autonomous hacking platform used by cybercriminals to conduct large-scale, financially motivated attacks. It leverages AI agents to discover and exploit web vulnerabilities such as Remote Code Execution (RCE) and conduct supply chain attacks with minimal human interaction. The platform, originally open-source, has been forked and remains publicly accessible despite being closed by its developer. ARTEX operators primarily use Chinese AI models and deploy attacks broadly, targeting various industries including gray-market code-signing certificate shops. Misconfigurations expose many ARTEX instances publicly, enabling remote access to administrative interfaces and operator data.
CVE-2026-112109 is a local privilege escalation vulnerability in Thales SafeNet Authentication Client Service (SACSrv). It allows an authenticated, non-administrator local user to trigger a heap-based buffer overflow via the service interface. Exploitation can lead to arbitrary code execution with Local System privileges. This affects SAC versions up to and including 10.9 R3 GA (build 10.9.7449).
CVE-2026-97847 is an improper authentication vulnerability in the Red Hat build of Keycloak 26.4. It arises from a flaw in the protocol mapper and identity resolution components, where sessionless service-account tokens can be manipulated via hardcoded-claim mappers. This allows an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.
CVE-2026-97175 is a high-severity vulnerability in the idp-auto-link authenticator of the Red Hat build of Keycloak 26.6.8. The flaw allows an attacker to take over a victim's account by exploiting automatic linking of external identities based on unverified email addresses. The issue arises because Keycloak does not verify whether the external identity provider has validated the email before linking it to a local account. This can lead to full account takeover, including changing the victim's email and password. No effective mitigation or patch is currently available according to Red Hat.
CVE-2026-97174 is a vulnerability in the Client-Initiated Backchannel Authentication (CIBA) implementation of the Red Hat build of Keycloak 26.6.8. The flaw allows improper validation of the 'sub' parameter, which can be injected and stored as an additional request parameter. This injected value overwrites the legitimate subject identifier during token issuance, enabling an attacker to authenticate as themselves but receive security tokens for a different victim user, resulting in unauthorized account access.
CVE-2026-96453 is a vulnerability in the Red Hat build of Keycloak 26.4 Admin CLI tool (kcadm). When administrators use a custom truststore to verify server identity, the tool improperly accepts any self-signed certificate if the hostname matches. This flaw allows a network attacker positioned to intercept traffic to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.
A vulnerability in the SAML adapter component of the Red Hat build of Keycloak 26.4 allows improper verification of the cryptographic signature issuer. This flaw enables an attacker controlling an identity provider that shares a trusted signing key to forge valid SAML assertions and authenticate as any user, potentially gaining full administrative access.
CVE-2026-92857 is a vulnerability in Red Hat's build of Keycloak 26.4 involving improper input validation in the Dynamic Client Registration feature. Attackers with valid Initial Access Tokens and realm accounts can exploit this flaw to forge identity claims in signed tokens by manipulating protected fields such as user ID (sub) and audience (aud). This allows impersonation of other users and unauthorized access to services relying on these tokens for identity verification. No effective mitigation is currently available that meets Red Hat's criteria for ease of use and stability.
CVE-2026-92855 is a vulnerability in the SAML identity broker component of the Red Hat build of Keycloak 26.4. The flaw allows an attacker who intercepts a signed SAML assertion to replay it and impersonate the victim without possessing the victim's private key. This occurs because the broker does not verify proof of key possession for holder-of-key assertions. Exploitation requires obtaining a valid signed assertion. No effective mitigation is currently available according to Red Hat.
CVE-2026-120859 is a high-severity vulnerability in PyMoDAQ and related packages that allows arbitrary code execution via deserialization of untrusted data and eval injection. The flaw affects PyMoDAQ versions before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils versions before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10. Attackers can exploit this by supplying crafted files that are opened by a user, leveraging unsafe deserialization and evaluation of Python objects embedded in HDF5, .dock, or XML files. Fixed versions are available.
A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.
Microsoft announced a new initiative to reduce security risks for on-premises server workloads such as Exchange Server, SharePoint Server, and Skype for Business Server. The initiative focuses on improving security posture by providing guidance, encouraging migration to cloud services, and hardening on-premises products with a baseline security mode. This mode aims to simplify secure configuration, accelerate patch deployment including automatic updates, and introduce emergency mitigations to reduce exposure to emerging threats. The goal is to reduce manual security management while maintaining administrator control and adapting protections as threats evolve.
Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.
The dsh-purge package version 1.2.1 on npm contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
This Microsoft Security update from November 2026 introduces new capabilities to manage and contain AI agents and improve endpoint privilege management. Key features include Dynamic Permissions for task-scoped agent authority, Microsoft Execution Containers for OS-enforced containment of AI agents, expanded least-privilege controls via Microsoft Intune Endpoint Privilege Management, and enhanced visibility and management of local AI agents through Microsoft Defender. The update also simplifies SQL Server protection deployment in Azure Government and improves security posture prioritization with Microsoft Security Exposure Management. These enhancements aim to reduce risk by limiting AI agent authority, adapting access dynamically based on risk, and providing security teams with clearer insights and expert-led protection.
h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with builtins reachable, name an arbitrary module in class or custom-object nodes that _import_class() imports, or place pickled objects in pd_dataframe or pd_series nodes that pandas deserializes on read.