Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.
CVE-2026-103009 is a high-severity authorization bypass vulnerability in Elasticsearch affecting versions 8.13.0 through 8.19.22, 9.0.0 through 9.4.7, and 9.5.0 through 9.5.4. It involves the Remote Cluster Security 2.0 model where a cross-cluster search request can be crafted to bypass authorization checks by using mismatched shard identifiers. This allows an attacker with a cross-cluster API key authorized for one index to access documents, field mappings, and metadata of an unauthorized index, and in limited cases modify retention-lease state. The vulnerability has a CVSS score of 7.1 and no known exploits in the wild have been reported. Patch status is not confirmed from the provided data.
CVE-2026-102413 is an uncaught exception vulnerability in Elastic Endpoint, part of Elastic Agent and Elastic Defend, triggered by processing specially crafted file names under certain system locale settings on Windows. This causes the Elastic Endpoint process to crash and restart repeatedly, potentially degrading or disabling real-time malware prevention and behavioral detection on the affected host. The issue affects multiple versions from 8.19.13 through 9.5.4. The vulnerability has a CVSS score of 6.2, indicating medium severity.
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required pull-request review but did not restrict branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content. This vulnerability affected supported GitHub Enterprise Server releases in the 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported via the GitHub Bug Bounty program.
A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.
A heap-based buffer overflow vulnerability exists in lrzsz versions before 0.13.0 in the procheader() function of the lrz receive utility. This occurs when overlong sender-supplied filenames (up to 8192 bytes) are copied into a fixed-size buffer, leading to heap memory corruption and potential crashes. The flaw arises from unsafe use of sprintf() or strcpy() in pipe mode. The vulnerability has a medium severity score of 6.1 and requires user interaction for exploitation.
CVE-2026-105841 is an OS command injection vulnerability in lrzsz before version 0.13.0. The flaw exists in the lrz receive utility's pipe mode when run under suffixed names like lrztar. It allows remote senders to execute arbitrary commands by supplying crafted filenames that are passed unescaped to popen(). This vulnerability has a high severity rating with a CVSS score of 7.7.
CVE-2026-105840 is a path traversal vulnerability in the lrzsz utility before version 0.13.0. It affects the lrz receive utility's restricted mode, allowing attackers to write files outside the current directory by using absolute pathnames. The vulnerability arises because the pathname check only rejects '../' sequences unless built with a specific option, enabling malicious ZMODEM senders to overwrite any file writable by the receiving user.
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replicas pointing at attacker-controlled endpoints to serve poisoned disk-tier reads and fake key existence.
Mooncake Store versions up to 0.3.13.post1 have a missing authorization vulnerability that allows unauthenticated attackers to delete disk replicas of objects. This can be exploited via the EvictDiskReplica and BatchEvictDiskReplica functions by accessing the coro_rpc master port, potentially deleting objects whose only remaining replica is on disk.
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.
Mooncake Store versions up to 0.3.13.post1 have a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via specific functions on the coro_rpc port. This can lead to cache loss and request failures.
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments.
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.13 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.12, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)
* Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543)
* Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543)
* Information disclosure and data deletion via second-order SQL injection (CVE-2026-0603)
* GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
* unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
* High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)
* HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)
* HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)
* Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
* Denial of Service via malformed HAProxy message (CVE-2026-44893)
* Denial of Service due to resource leak (CVE-2026-48043)
* Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)
* Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
* Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
* Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
* Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
* Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
* Denial of Service via deeply nested JSON processing (CVE-2026-50193)
* Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
* Missing authentication on EAP's IIOP NameService leads to MITM or DoS (CVE-2026-15563)
* Session fixation in OIDC login flow that can lead to account takeover (CVE-2026-7507)
* Denial of Service via specially crafted SAML input (CVE-2026-7307)
* Denial of Service due to excessive SAMLRequest decompression (CVE-2026-2575)
* Denial of Service via excessive processing of OpenID Connect scope parameters (CVE-2026-4634)
* Unauthorized access via improper validation of encrypted SAML assertions (CVE-2026-2092)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-104853 is a path traversal vulnerability in the nx tool's migrate command. It occurs because the migration file path from a package manifest is not validated, allowing extraction outside the intended temporary directory. This can lead to attacker-controlled file writes or truncation of files writable by the user, potentially enabling code execution if critical files are overwritten. The vulnerability affects nx versions from 13.10.0 up to but not including 22.7.10, and from 23.0.0 up to but not including 23.2.1. Most users running nx migrate normally are not exposed because the tool fetches and runs the latest patched nx version. Exposure occurs only if the local vulnerable nx version is forced to run. A fix is available in versions 22.7.10 and 23.2.1. No known exploitation in the wild has been reported.
A vulnerability in the Linux kernel's x86 kprobes subsystem causes a crash when probing CS CALL instructions using eBPF tools. The issue arises because the kprobe handler incorrectly assumes a fixed 5-byte CALL instruction length, while the CS-prefixed CALL instruction is 6 bytes long. This leads to an invalid exception return address and a kernel crash. The flaw affects Linux kernel versions 5.10.190 through before 5.11 and version 5.13. The issue has been fixed in version 5.11.
CVE-2026-98254 is a high severity vulnerability in the Linux kernel's swiotlb subsystem affecting versions >=5.10.47 <5.11, >=5.12.14 <5.13, and =5.13. The flaw involves incorrect handling of adjusted addresses for high memory page lookups during DMA operations, causing data to be copied to or from incorrect memory pages. This can lead to data corruption and stale data issues. The vulnerability has been fixed in Linux kernel versions 5.11, 5.13, and related commits.