CVE-2026-78323 is a vulnerability in Red Hat Certificate System 10's Java Security Services (JSS) where the JSSTrustManager class improperly validates CA certificates by not checking NSS trust flags. This flaw allows certificates without TRUSTED_CA flags in the NSS database to be accepted as trust anchors for TLS connections if certificate revocation checking is disabled. The vulnerability is mitigated in default configurations where revocation checking is enabled. The server-side TLS validation path is not affected. The CVSS score is 6.5, indicating a medium severity.
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.
Security Fix(es):
* libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
Security Fix(es):
* openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)
* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)
Bug Fix(es) and Enhancement(s):
* Openssl builds failing in rhel6 due to failing tests (JIRA:RHEL-184262)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for Red Hat Hardened Images RPMs addresses multiple vulnerabilities including CVE-2026-65898 and related CVEs. The update involves the grafana12.4 package version 12.4.8-0.1.2.hum1 for aarch64 and x86_64 architectures. These vulnerabilities have medium severity and are fixed in this update. The advisory covers several CVEs related to these packages and provides a link for applying the update.
Multiple security vulnerabilities have been identified and fixed in apr-util, including a timing attack vulnerability in apr_password_validate(), XML stack recursion crash, SQL injection in apr_dbd_oracle, and heap buffer overflows in Redis and memcached clients. The timing attack vulnerability allows potential leakage of password hash content via side-channel timing differences but is assessed as low impact due to practical exploitation difficulties. Red Hat has released updated apr-util packages to address these issues.
A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure.
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise.
A security update for Red Hat Hardened Images addresses multiple vulnerabilities in python3.11 packages, including CVE-2026-3479, a path traversal flaw in Python's pkgutil.get_data() function. This flaw allows local attackers to access files outside intended directories due to improper validation of resource arguments. The advisory indicates medium severity for these vulnerabilities and provides updated RPM packages for remediation. No explicit patch version is stated beyond the updated package versions. No current mitigation meets Red Hat's criteria for ease of use and applicability.
CVE-2026-66788 is a critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.16's Lighthouse component. It allows a remote attacker who has compromised a spoke cluster to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This can lead to privilege escalation or other system compromises within the cluster.
CVE-2026-66787 is a vulnerability in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. It involves insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this flaw to redirect legitimate service traffic to malicious endpoints, enabling transparent Man-in-the-Middle (MITM) attacks on cross-cluster communications. This can lead to unauthorized information disclosure and data manipulation. The vulnerability has a high severity with a CVSS score of 8.7. Red Hat has addressed this issue in version 2.17 with security fixes and updated container images.
CVE-2026-66785 is a vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.16 involving Submariner, a Kubernetes operator for cross-cluster connectivity. A malicious spoke cluster can publish crafted network endpoints with arbitrary network subnets, causing network traffic from peer clusters to be redirected through the attacker's tunnel. This improper validation of network subnets can lead to unauthorized information disclosure or network disruption. Red Hat has released fixes in version 2.17 and Submariner v0.24 to address this issue.
Red Hat has issued a security advisory for PHP 8.2 addressing two vulnerabilities: a SQL injection vulnerability in the ext-pgsql extension due to improper backslash escaping (CVE-2026-17543) and a denial of service vulnerability caused by circular symbolic links in phar archives (CVE-2026-7260). The update rebases PHP to version 8.2.33 to fix these issues. The advisory rates the security impact as Important and affects Red Hat Enterprise Linux 8 and related variants.
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)
* vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177)
* vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)
* vim: command injection when decompressing .tgz archives (CVE-2026-46483)
* vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162)
* vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858)
* vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167)
* vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
* vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
* vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
* vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)
* vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)
* vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)
* vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.
A vulnerability in libxml2's XML catalog parsing can cause a denial of service (DoS) due to a NULL pointer dereference when a nextCatalog element lacks its mandatory catalog attribute. This flaw requires processing a specially crafted XML catalog by an application using libxml2, leading to application crashes. The issue affects Red Hat Hardened Images RPMs and has been addressed in updated libxml2 packages.
CVE-2026-19611 is a vulnerability in WildFly Elytron used in the Red Hat Build of Apache Camel 3.33.3.SP2. It involves improper handling of password input normalization using Unicode NFKC, which can reduce the complexity of passwords containing fullwidth characters by collapsing them to ASCII equivalents. This flaw allows remote attackers to more easily guess passwords using ASCII-only dictionaries, potentially leading to unauthorized access. A security update addressing this issue is included in Red Hat build of Quarkus 3.27.5.SP2.