CVE-2026-76077 is a classic buffer overflow vulnerability in the ASN1SCC ASN.1 compiler for embedded systems, specifically in the XER tokenizer function NT() prior to version 4.7.0.1. The vulnerability arises from copying tag characters into a fixed-size buffer without proper length checks, allowing crafted XER messages to overwrite stack memory, cause crashes, hangs, or potentially enable code execution. This flaw is fixed in version 4.7.0.1.
CVE-2026-75615 is an out-of-bounds read vulnerability in the esa asn1scc ASN.1 compiler for embedded systems. Versions prior to 4.7.0.1 do not properly validate decoded character indices in certain runtime and generated decoder functions, allowing crafted messages to read adjacent static program constants. The vulnerability affects string alphabets whose size is not a power of two; the full 128-character IA5String alphabet is not impacted. This issue is fixed in version 4.7.0.1.
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.
OpenHuman versions prior to 0.57.44 have a security vulnerability in the local /ws/dictation WebSocket endpoint, which lacks client authentication and browser-origin validation. This allows unauthenticated clients, including malicious web pages, to submit audio and trigger resource-intensive speech-to-text processing. Earlier versions also have an unbounded audio buffer, enabling continuous streaming that can exhaust process memory and degrade or crash the application. The issue is fixed in version 0.57.44.
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, background synchronization for connected services such as email, Slack, and Notion stores raw external content and later places it in the model context of autonomous background agents without neutralizing embedded instructions. ApprovalGate treats tool calls without an interactive chat context as pre-authorized automation, so attacker-authored content processed during a background tick can influence the model to invoke Composio actions without presenting an approval request. An attacker who can deliver content to a connected account can use this path to send or forward data, post messages, create or modify third-party content, or disclose information from OpenHuman memory and integrations. The issue requires an active integration and successful model interpretation of the injected instructions. This issue is fixed in version 0.57.13.
Red Hat has issued a security advisory for kernel live patch modules targeting kernel-4.18.0-553.109.1.el8_10 in Red Hat Enterprise Linux 8. The update addresses three security issues: limiting IPC next_id allocation to valid ranges (CVE-2026-52923), fixing a potential use-after-free in UDP tunnel segmentation (CVE-2026-74705), and bounding receive headroom in the tun network driver (CVE-2026-81000). These vulnerabilities are rated with an important security impact by Red Hat. The advisory provides updated kpatch packages to remediate these issues. For detailed application instructions, Red Hat references their update documentation.
CVE-2026-54146 is a vulnerability in the open-source tinyhumansai openhuman agent on macOS versions from 0.53.15 up to but not including 0.57.5. The issue involves the cleartext storage of the OPENHUMAN_CORE_TOKEN bearer credential in the process environment, which can be accessed by other processes running as the same user via macOS's KERN_PROCARGS2 interface. This allows unauthorized processes to authenticate to the core JSON-RPC service with desktop frontend privileges, enabling reading of agent memory, accessing integrated-account data, invoking privileged actions, and disrupting services without elevated system permissions. The vulnerability affects both Intel and Apple Silicon macOS systems and is fixed in version 0.57.5.
CVE-2026-54143 is a critical OS command injection vulnerability in the open-source OpenHuman agent by tinyhumansai. Versions prior to 0.57.13 allow an attacker who can send messages to a configured external channel to create persistent shell cron jobs without user approval. These jobs execute with the privileges of the OpenHuman runtime user. The vulnerability also permits leading environment assignments that can redirect allowed commands to executable helpers already present on the host. This can lead to unauthorized persistent command execution and compromise of data and resources accessible to OpenHuman. The issue is fixed in version 0.57.13.
Two denial of service vulnerabilities have been identified in the Qt software toolkit's XML handling components. These issues involve uncontrolled recursion in XML serialization (CVE-2026-11573) and a denial of service vulnerability in XML parsing (CVE-2026-19248). The vulnerabilities affect the qt5-qtbase and qt6-qtbase packages used in Red Hat Enterprise Linux 9.4 and related distributions. Red Hat has issued security updates to address these issues.
Red Hat issued a critical security advisory for webkit2gtk3 addressing multiple vulnerabilities in the ANGLE component used by Chromium-based browsers. These include arbitrary code execution, information disclosure, buffer overflow, use-after-free, improper input validation, and uninitialized resource issues. The update also fixes a regression affecting Eclipse IDE WebKit-based views on CentOS Stream 8.
OpenHuman versions prior to 0.57.13 contain a code injection vulnerability via remote direct messages sent through a configured Yuanbao channel. This flaw allows an external sender to execute JavaScript and operating system commands as the OpenHuman user without an approval prompt under certain policy and configuration conditions. The vulnerability is fixed in version 0.57.13.
Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive.
To remediate this issue, users should upgrade to version 0.17.0 or later.
OpenHuman versions before 0.56.0 have an authentication bypass vulnerability in the Socket.IO handlers. While HTTP POST requests to /rpc are protected by bearer token middleware, the Socket.IO rpc:request and chat:start handlers lack equivalent authentication. This allows a local unauthenticated client to connect and invoke sensitive operations such as reading configuration or health data, starting agent flows, interacting with account APIs, modifying local data, or stopping and restarting services. The issue is fixed in version 0.56.0.
OpenHuman versions prior to 0.57.5 use the JSON-RPC bearer token as an approval session identifier, which is exposed in persisted approval records, events, debug logs, and RPC responses. This exposure allows an attacker who obtains these artifacts to recover the token and access the core RPC interface with the privileges of the token. The vulnerability can lead to exposure of sensitive agent and integration data and permit privileged operations. The issue is fixed in version 0.57.5.
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied client_id to select WebChannelEvent objects from the process-wide event bus. An unauthenticated local client, or an attacker-hosted web page opened by the victim, can subscribe to another client's stream by supplying a known or guessed identifier; the fixed system identifier makes the proactive-message stream predictable. The exposed events can include complete assistant responses, streamed message content, tool names, tool arguments, and raw tool outputs intended for the local user interface. This issue is fixed in version 0.56.0.
CVE-2026-111253 is a vulnerability in dnf5daemon-server affecting Red Hat Hardened Images where session methods on dynamically exported D-Bus session objects fail to verify the caller's identity. This allows a local attacker to modify another user's live package-management session and replace its resolved transaction plan. If the legitimate user authorizes the execution, the root daemon may apply the attacker's chosen package operations. Red Hat Enterprise Linux is not affected as it does not ship dnf5daemon-server. The vulnerability has a CVSS score of 6.6 (medium severity).
CVE-2026-118517 is a vulnerability in the Symfony HtmlSanitizer component's UrlSanitizer that causes it to parse URLs differently from browsers. This discrepancy allows bypassing host allow-list checks for URLs without a well-formed authority, leading to untrusted hosts being referenced in sanitized output. The issue affects Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The default configuration is not affected.
OpenHuman before version 0.56.0 on macOS contains an improper authorization vulnerability that allows JavaScript in a remote account webview to invoke getDisplayMedia without a live user gesture. This leads to automatic screen capture if the application has macOS Screen Recording permission, potentially exposing sensitive desktop content. The issue is fixed in version 0.56.0.
OpenHuman before version 0.57.13 improperly neutralizes input used for large language model (LLM) prompting from external MCP servers. This allows a malicious or compromised MCP server to inject crafted descriptions that are evaluated on every agent turn, potentially causing the model to invoke unauthorized tools, disclose data, or perform unauthorized actions without explicit user commands. The vulnerability is fixed in version 0.57.13.