OpenHuman before version 0.57.13 improperly neutralizes input used for large language model (LLM) prompting from external MCP servers. This allows a malicious or compromised MCP server to inject crafted descriptions that are evaluated on every agent turn, potentially causing the model to invoke unauthorized tools, disclose data, or perform unauthorized actions without explicit user commands. The vulnerability is fixed in version 0.57.13.
Red Hat has released a security update for the java-11-openjdk packages with Extended Lifecycle Support for Red Hat Enterprise Linux versions 7, 8, and 9. This update addresses multiple security vulnerabilities in OpenJDK 11, including enhancements to SASL authentication, PKCS5 padding, TLS certificate handling, LDAP logins, HTTP client and server handling, XML processing, and various other components. The update is important and addresses a broad range of security issues to improve the security posture of the Java runtime environment and development kit.
CVE-2026-102739 is a deserialization vulnerability in the ESPectre Wi-Fi motion sensing platform for ESP32. Versions prior to 3.0.0-rc1 load NPZ datasets with pickle support enabled, allowing a maliciously crafted dataset to execute arbitrary code when analyzed by certain tools. This issue is fixed in version 3.0.0-rc1.
A stack-based buffer overflow vulnerability exists in the GNU debugger (GDB) as shipped with Red Hat Enterprise Linux 10. This flaw occurs when GDB connects to a remote debug target and parses the target's replies, allowing a malicious target to overflow a stack buffer. The overflow triggers automatically during the remote connection handshake, potentially crashing GDB or enabling arbitrary code execution with the privileges of the user running GDB. There is no available mitigation other than connecting GDB only to trusted debug targets.
CVE-2026-121997 is a heap-based buffer overflow vulnerability in the gdbserver component of Red Hat Enterprise Linux 10. It arises from a mismatch between a packet's declared source length and the actual data length in the QTDPsrc packet handler, causing the hex2bin function to write beyond the allocated heap buffer. This flaw allows an unauthenticated remote attacker with network access to the exposed gdbserver port to execute arbitrary native code with the privileges of the gdbserver process. There is no authentication in gdbserver, and no mitigation other than limiting network exposure to the gdbserver port. The vulnerability has a high CVSS score of 8.1, reflecting its potential impact on confidentiality, integrity, and availability.
CVE-2026-121996 is a vulnerability in the gdbserver component of Red Hat Enterprise Linux 10. It involves a length validation flaw in the agent-expression parser that allows unauthenticated remote attackers with network access to an exposed gdbserver port to read uninitialized heap memory and cause a denial of service by crashing gdbserver. The disclosed heap content includes addresses that could be used to bypass ASLR in further attacks. There is no authentication in gdbserver, and no mitigation other than limiting network exposure to the gdbserver port.
CVE-2026-121995 is a stack-based buffer overflow vulnerability in the GDB client's tracepoint upload handler as shipped with Red Hat Enterprise Linux 10. This flaw occurs during the target remote connection handshake when the remote debug stub reports tracepoint support, causing GDB to read beyond the current reply boundary into stale data in the shared packet buffer. The overflow can corrupt stack memory automatically during connection setup. There is no mitigation other than connecting GDB only to trusted debug targets.
CVE-2026-121994 is a stack-based buffer overflow vulnerability in the GDB client's remote protocol handler shipped with Red Hat Enterprise Linux 10. It occurs in the function fetch_register_using_p, which improperly decodes a stub's register reply into an alloca-sized buffer without proper bounds checking. This flaw allows an attacker-controlled debug target to execute arbitrary code within the GDB process. There is no available mitigation other than avoiding connection to untrusted debug targets.
A stack-based buffer overflow vulnerability (CWE-121) exists in ntopng prior to version 6.7.260721. The flaw occurs in the function ndpi_get_custom_category_match, which writes a four-byte value into a two-byte variable during packet processing. This can be triggered remotely by an unauthenticated attacker on a monitored network segment by sending packets that match custom-category rules, leading to stack corruption and denial of service. The issue is fixed in version 6.7.260721.
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.
A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.
CVE-2026-82413 is a command injection vulnerability in ntopng, a network traffic monitoring application, affecting versions prior to 6.7.260717. The flaw arises from insufficient validation of the scan_ports parameter in certain Lua scripts, allowing authenticated users or unauthenticated users if login is disabled, to inject shell metacharacters. This leads to arbitrary command execution with the privileges of the ntopng service account when nmap is installed. The issue is fixed in version 6.7.260717.
HomeBox versions prior to 0.27.0 have a vulnerability where email addresses are treated as case-sensitive during user registration but case-insensitive during login. This discrepancy allows an unauthenticated attacker to register an email address variant with different casing, bypassing the one-account-per-email policy and causing login failures for both variants, effectively denying access to the legitimate user. The issue is resolved in version 0.27.0.
CVE-2026-75599 is a cross-site scripting (XSS) vulnerability in sysadminsmedia HomeBox, a home inventory and organization system. Versions prior to 0.27.0 allow authenticated users to store javascript: URIs in markdown-style links within entity custom-field values. These links are rendered as clickable anchors on item pages, enabling execution of attacker-controlled JavaScript when clicked by other authenticated users. This can lead to session theft, account takeover, or data exfiltration. The issue is fixed in version 0.27.0.
HomeBox versions prior to 0.27.0 have a timing side-channel vulnerability in the login endpoint. The POST /api/v1/users/login endpoint verifies password hashes only for existing usernames, while unknown usernames return immediately. Although both cases respond with a 401 unauthorized status, the difference in processing time allows remote attackers to distinguish valid registered email addresses. This information disclosure vulnerability is fixed in version 0.27.0.