The bundled JAAS login modules have a vulnerability that leaks information about whether a username exists and perform credential comparisons in a non-constant-time manner. This allows a remote unauthenticated attacker to enumerate valid accounts and potentially infer credential material through timing analysis. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
Docker Desktop versions prior to 4.94.0 could log the signed-in user's Docker Hub access token (JWT) in cleartext within application logs and diagnostic bundles. This occurred because IPC payloads that were bare JSON strings or arrays were not redacted before logging, allowing a component to log the token when requesting it from the backend. An attacker with read access to these logs could obtain the token and use it to access and modify the user's Docker Hub data while the token remains valid. Version 4.94.0 of Docker Desktop introduces redaction of these payloads to prevent token exposure. However, logs created by earlier versions are not rewritten and may still contain tokens after upgrading.
Eclipse Kura versions 5.0.0 through 5.6.2 contain a vulnerability in the Wire Graph update functionality of the Kura Web UI and the Wire Service REST API v1. An authenticated user with only Wires management permissions can modify or replace configurations of components outside the Wire Graph, including security-relevant components. This can lead to escalation to full administrative privileges and potential device disruption. The vulnerability requires at least one Driver installed on the device. The issue is fixed in version 5.6.3.
A vulnerability in the stateful session bean passivation mechanism allows a remote attacker with access to the remote EJB service to cause session state to be read from or written to files outside the intended passivation directory. This occurs because the on-disk file name is derived from a client-supplied identifier without proper validation. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
A vulnerability in Podman allows an attacker to cause a Denial of Service (DoS) by supplying a container image with crafted metadata labels. Podman's auto-update mechanism trusts these labels to decide which system services to restart. If a user runs such a malicious container and auto-update processes it, arbitrary systemd services may be restarted with the user's privileges, potentially shutting down the host system if Podman runs with administrative rights. The vulnerability requires user interaction to pull and run an untrusted container image. In default Red Hat Enterprise Linux configurations, the auto-update timer is disabled, and rootless containers have limited systemd control, reducing risk.
A vulnerability exists in the internal system EJBs used for remote deployment and configuration when the server runs with the default profile. These EJBs do not enforce their administrative role check, allowing a remote unauthenticated attacker who can reach the remote EJB endpoint to deploy arbitrary applications and execute code. Only installations with enabled system applications and a remote EJB endpoint are affected. Upgrading to versions 10.3.0 or 11.0.0-M2 addresses this issue.
A vulnerability in EJB JAX-WS endpoints with configured authentication allows remote unauthenticated attackers to bypass authentication by using HTTP methods not protected by the security constraint. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
An authentication bypass vulnerability exists in Apache TomEE when an EJB JAX-WS endpoint is published within an existing web application. The authentication configured in the TomEE deployment descriptor is not enforced, allowing remote unauthenticated attackers to invoke web service operations unless additional security constraints are applied by the application. Upgrading to TomEE versions 10.3.0 or 11.0.0-M2 addresses this issue.
CVE-2026-124951 is a privilege escalation vulnerability in the Nimbus Desktop Client component. This security flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The vulnerability allows an attacker to gain elevated privileges within the affected software component.
CVE-2026-124952 is a use-after-free vulnerability in the Audio/Video component of Firefox ESR. This flaw was addressed and fixed in Firefox ESR version 115.45. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating it can lead to high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Users are advised to update to the fixed version to mitigate the risk.
CVE-2026-124950 is a same-origin policy bypass vulnerability in the CSS Parsing and Computation component of Firefox. This security flaw allows bypassing the browser's same-origin policy, which is critical for web security. The issue was addressed and fixed in Firefox version 160. No public exploit or in-the-wild exploitation has been reported. The vulnerability is considered high impact due to the potential security implications of same-origin policy bypasses.
The Jakarta Security LDAP identity store fails to neutralize special characters in the caller name before using it in directory queries. This vulnerability allows a remote unauthenticated attacker to manipulate LDAP queries to enumerate accounts, infer directory attribute values, or affect which directory entry is used for login validation. The issue affects only applications using the LDAP identity store. Upgrading to versions 10.3.0 or 11.0.0-M2 resolves the vulnerability.
The V programming language standard library net.http up to version 0.5.2 contains a TLS certificate validation bypass vulnerability. This flaw arises because the default configuration for SSLConnectConfig.validate and FetchConfig.validate is false, causing TLS handshakes to complete without verifying certificates in both mbedtls and OpenSSL backends. As a result, attackers can intercept or modify HTTPS traffic by presenting invalid certificates such as expired, self-signed, wrong-hostname, or untrusted-root certificates unless the validate option is explicitly set to true.
CVE-2026-124949 is a security vulnerability in the SVG component of Firefox. It was addressed and fixed in Firefox version 160. The vulnerability is classified as high impact by Mozilla. No further technical details or exploitation information are provided in the advisory.
CVE-2026-124948 is a high-severity vulnerability involving incorrect boundary conditions leading to a use-after-free flaw in the Graphics component of Firefox. This vulnerability allows potential exploitation impacting confidentiality, integrity, and availability. It was fixed in Firefox 160 and Firefox ESR 153.7.
CVE-2026-124946 is a vulnerability involving an invalid pointer in the JavaScript Engine's JIT component in Firefox. This flaw was addressed and fixed in Firefox version 160. The issue is part of a broader set of high-impact security vulnerabilities resolved in the same release.
CVE-2026-124945 is a high-impact vulnerability involving an invalid pointer in the Layout: Text and Fonts component of Firefox. This flaw was addressed and fixed in Firefox version 160. The issue could potentially lead to memory corruption or other critical impacts related to pointer misuse within the layout engine's text and fonts handling.
CVE-2026-124947 is a high-severity vulnerability involving incorrect boundary conditions in the Graphics component of Firefox. This flaw was addressed and fixed in Firefox version 160. The vulnerability could potentially lead to significant impacts on confidentiality, integrity, and availability if exploited.
CVE-2026-124943 is a use-after-free vulnerability in the Layout component of Firefox. This flaw was addressed and fixed in Firefox version 160. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating it can lead to significant confidentiality, integrity, and availability impacts if exploited.
CVE-2026-124942 is a vulnerability involving an invalid pointer in the DOM Streams component of Firefox. This flaw was addressed and fixed in Firefox version 160 and Firefox ESR 153.7. The issue could potentially lead to high impact security concerns as indicated by the vendor advisory.