A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.
CVE-2026-82413 is a command injection vulnerability in ntopng, a network traffic monitoring application, affecting versions prior to 6.7.260717. The flaw arises from insufficient validation of the scan_ports parameter in certain Lua scripts, allowing authenticated users or unauthenticated users if login is disabled, to inject shell metacharacters. This leads to arbitrary command execution with the privileges of the ntopng service account when nmap is installed. The issue is fixed in version 6.7.260717.
HomeBox versions prior to 0.27.0 have a vulnerability where email addresses are treated as case-sensitive during user registration but case-insensitive during login. This discrepancy allows an unauthenticated attacker to register an email address variant with different casing, bypassing the one-account-per-email policy and causing login failures for both variants, effectively denying access to the legitimate user. The issue is resolved in version 0.27.0.
CVE-2026-75599 is a cross-site scripting (XSS) vulnerability in sysadminsmedia HomeBox, a home inventory and organization system. Versions prior to 0.27.0 allow authenticated users to store javascript: URIs in markdown-style links within entity custom-field values. These links are rendered as clickable anchors on item pages, enabling execution of attacker-controlled JavaScript when clicked by other authenticated users. This can lead to session theft, account takeover, or data exfiltration. The issue is fixed in version 0.27.0.
HomeBox versions prior to 0.27.0 have a timing side-channel vulnerability in the login endpoint. The POST /api/v1/users/login endpoint verifies password hashes only for existing usernames, while unknown usernames return immediately. Although both cases respond with a 401 unauthorized status, the difference in processing time allows remote attackers to distinguish valid registered email addresses. This information disclosure vulnerability is fixed in version 0.27.0.
CVE-2026-119344 is a critical origin validation error in the Cocos AI confidential computing system versions 0.8.2 and earlier. The vulnerability allows a remote attacker controlling another trusted platform to substitute valid attestation Evidence, causing authorization of an incorrect platform. This flaw arises because the system accepts attestation Evidence without binding it to a unique platform owner or enforcing revocation. The issue is addressed in version 0.9.0, but cannot be fully mitigated by source code changes alone due to the underlying confidential computing threat model.
Cluster Observability Operator 1.5 for Red Hat OpenShift provides observability capabilities for cloud-native applications. A security advisory has been issued addressing multiple vulnerabilities including CVE-2026-19534. The advisory references a set of fixes and instructs users to apply updates according to Red Hat's documentation. No specific affected versions are detailed in the advisory. There are no known exploits in the wild for this CVE at the time of publication.
CVE-2026-123125 is a vulnerability in the Symfony Validator component's IpValidator that causes incomplete classification of internal IP addresses in certain filtered modes of the Ip constraint. This flaw allows some internal addresses to be incorrectly accepted as public, potentially enabling Server-Side Request Forgery (SSRF) attacks. The issue affects Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The vulnerability arises because the PHP filter flags used do not cover shared address space or certain IPv6 address types that embed internal IPv4 addresses. Applications relying on this validation to block internal addresses before making server-side requests may be exposed to SSRF.
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0.
CVE-2026-104269 is a high-severity vulnerability in ModSecurity versions 3.0.0 through 3.0.16. The multipart parser in these versions does not correctly apply RFC 2231 precedence rules for the filename* parameter in Content-Disposition headers. This discrepancy allows an attacker to supply a benign filename parameter for ModSecurity inspection while the backend application uses a different encoded filename*, potentially bypassing WAF rules that rely on filename checks. The issue is fixed in version 3.0.17.
ModSecurity versions from 3.0.0 up to but not including 3.0.17 improperly handle case sensitivity when comparing response Content-Type headers against configured SecResponseBodyMimeType entries. This flaw allows a mixed-case response media type, semantically equivalent to a configured lowercase type, to bypass response body inspection. As a result, an unauthenticated attacker can receive response content that would normally be blocked by phase 4 rules, potentially exposing sensitive error or debug information. The issue is resolved in version 3.0.17.
ModSecurity versions prior to 2.9.15 and between 3.0.0 and before 3.0.17 contain an improper certificate validation vulnerability. The HttpsClient::download function sets libcurl's CURLOPT_SSL_VERIFYHOST option to 1 instead of the strict value 2, weakening TLS peer identity verification. This may increase the risk of accepting a certificate for an unintended host under man-in-the-middle or TLS interception scenarios. Exploitation is considered non-trivial in typical environments. The issue is fixed in versions 2.9.15 and 3.0.17.
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
A security update for the python36:3.6 module in Red Hat Enterprise Linux addresses a vulnerability in the pymongo MongoDB Python driver. The flaw, identified as CVE-2026-88029, involves query-operator injection that can lead to data disclosure and denial of service. Red Hat has rated this update as having an important security impact and has released patches for affected versions. The advisory references Red Hat Enterprise Linux 8.4 Extended Life Cycle Long Life and related packages. Users are advised to apply the update as detailed in the Red Hat advisory.
CVE-2026-103932 is a vulnerability in ModSecurity versions from 3.0.5 up to but not including 3.0.17. It involves an incorrect handling of PCRE2 match-limit errors in the @rxGlobal function, which causes certain rules to be bypassed when the SecPcreMatchLimit is exhausted. This can allow requests that should be blocked by the WAF to pass through. The issue is fixed in version 3.0.17.
Content Egg plugin for WordPress versions up to 12.0.0 contains a broken access control vulnerability. This flaw allows unauthenticated attackers to access product data from unpublished posts by exploiting a REST API endpoint that improperly permits requests without a valid nonce. The exposed data includes product titles, affiliate URLs, merchant information, and descriptions from draft, pending, scheduled, or private posts.