CVE-2026-123867 is a vulnerability in Node.js versions 22.x, 24.x, and 26.x that allows a client authorized for the default hostname to bypass mutual TLS (mTLS) authorization and access a protected hostname it is not authorized for. This occurs due to improper certificate validation when a TLS server assigns a hostname a different client-certificate CA without a server certificate in that SNI context, causing the server to fall back to the default client CA. As a result, a client with a certificate trusted by the default CA can complete mTLS to the protected hostname and read its response, even when requestCert and rejectUnauthorized are enabled. The issue is fixed in Node.js versions 22.23.5, 24.22.3, and 26.13.1.
Dell OpenManage Ansible Modules versions 2.0.4 through 10.0.3 contain an XML External Entity (XXE) vulnerability due to improper restriction in XML parsing. This flaw allows a low privileged local attacker to potentially expose sensitive information. The vulnerability is fixed in version 11.0.0 and later.
CVE-2026-123866 is a use-after-free vulnerability in Node.js HTTP/2 stream teardown that can cause response memory leakage. This flaw allows memory from other connections' response buffers to be sent to a peer when a stream is torn down during backpressure on writes. It affects Node.js versions 22.x, 24.x, and 26.x prior to specific fixed releases.
.NET 8.0 on Red Hat Enterprise Linux 8 has multiple security vulnerabilities including denial of service, information disclosure, and elevation of privilege issues affecting ASP.NET Core and .NET runtimes. These vulnerabilities are addressed in the updated SDK version 8.0.134 and runtime version 8.0.34. The update is rated as important by Red Hat Product Security and fixes several CVEs related to denial of service and privilege escalation.
CVE-2026-58505 is a high-severity vulnerability in the maplibre geojson-vt JavaScript library prior to version 6.1.1. The flaw is an uncontrolled recursion in the GeoJSON conversion logic that leads to a call stack overflow and process termination when handling deeply nested GeometryCollection objects. This can be triggered remotely without authentication by sending a crafted GeoJSON payload, resulting in a denial-of-service (DoS) condition. The issue is fixed in version 6.1.1.
CVE-2026-123865 is a high-severity vulnerability in Node.js HTTP/2 implementation affecting versions 22.x, 24.x, and 26.x prior to fixed releases. An unauthenticated HTTP/2 client can cause permanent memory and file descriptor leaks by triggering protocol errors during session shutdown, leaving connections in CLOSE_WAIT state and consuming server resources indefinitely.
Dell OpenManage Ansible Modules versions 9.2.0 through 10.0.3 contain an improper certificate validation vulnerability in the SessionAPI component. This flaw allows an unauthenticated remote attacker to potentially cause information exposure and unauthorized access. The vulnerability is fixed in version 11.0.0 and later.
CVE-2026-123864 is a use-after-free vulnerability in Node.js HTTPS that allows an unauthenticated client to read memory from other connections, including sensitive data such as TLS private keys and other users' requests. The flaw arises from a re-entrancy issue during TLS record processing triggered by specific HTTP handler behaviors involving res.flushHeaders() and res.end(). It affects Node.js versions 22.x, 24.x, and 26.x prior to the fixed releases.
CVE-2026-123863 is a high-severity vulnerability in Node.js HTTP/2 session teardown that allows any unauthenticated client to abort the server process. The flaw arises from a reachable assertion failure triggered when an Http2Stream holding nghttp2-allocated header buffers outlives its session, causing the server to terminate unexpectedly. This affects Node.js versions 24.x from 24.0.0 up to but not including 24.22.3, and 25.x/26.x from 25.0.0 up to but not including 26.13.1. The vulnerability is a variant of CVE-2024-27983 and occurs when the server responds before the request body has ended, which is typical behavior. Fixed versions are 24.22.3 and 26.13.1.
CVE-2026-57500 is a vulnerability in the opencloud-eu Reva interoperability platform where internal metadata folders are exposed within authenticated users' spaces. This exposure occurs in versions prior to 2.40.5 and 2.46.4 and may allow unauthorized access to sensitive information. The issue has been fixed in versions 2.40.5 and 2.46.4.
The go-fdo-client, a Go implementation of the FIDO Device Onboard specification, has received a security update addressing two vulnerabilities: a denial of service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) and man-in-the-middle attacks due to untrusted intermediate certificates (CVE-2026-111943). These issues affect Red Hat Enterprise Linux 10.2 Extended Update Support and related variants. Red Hat has issued patches to remediate these vulnerabilities.
Dell OpenManage Ansible Modules versions 5.0.0 through 10.0.3 contain an improper certificate validation vulnerability in the iDRACConnection component. This flaw allows an unauthenticated remote attacker to potentially cause information exposure and unauthorized access. The vulnerability is fixed in version 11.0.0 and later.
CVE-2026-123862 is a low-severity vulnerability in Node.js versions 22.x, 24.x, and 26.x where an uncatchable exception can occur in the zlib streaming API. This happens when a peer disconnects during data compression using deflate.params(), causing an internal assertion failure that terminates the process. The issue arises because the stream's native handle is destroyed but the callback asserts its existence, leading to a process crash. This affects applications that call deflate.params() while streaming to a peer, which is uncommon.
CVE-2026-123829 is an information disclosure vulnerability in Node.js affecting versions prior to 22.23.5, 24.22.3, and 26.13.1. It arises from a permission model bypass in the recursive file watching feature on macOS and Windows. The vulnerability allows code with read permission on a directory to learn the names and timing metadata of files and directories deeper in the hierarchy that it does not have permission to read. This does not expose file contents, only names and metadata. The flaw is due to the native libuv watcher forwarding filenames without verifying read permissions on each path beyond the root watched directory.
OpsTree Solutions REMS versions up to 1.0.0 have an authorization vulnerability that allows authenticated users with lower privileges to post comments as the incident creator on incidents they do not own. This improper attribution flaw enables attackers to impersonate higher-privileged users, such as Super Users, potentially corrupting incident timelines and audit trails.
OpsTree REMS versions up to 1.0.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can exploit this by uploading attachments with a spoofed text/html Content-Type, such as HTML files disguised with double extensions (e.g., test.html.pdf). When these files are previewed in REMS, the embedded JavaScript executes in the context of the victim's browser.
OpsTree Solutions REMS versions up to 1.0.0 contain a server-side request forgery (SSRF) vulnerability. Authenticated users can exploit the database Test Connection feature to make the backend server connect to arbitrary destinations, including localhost, internal network addresses, or attacker-controlled servers. This allows attackers to probe internal hosts and ports accessible from the REMS server.
OpsTree Solutions REMS version 1.0.0 and earlier contains a missing authentication vulnerability that allows unauthenticated remote attackers to access critical Governance API endpoints. Attackers can retrieve sensitive database credentials by sending requests without valid authorization tokens.