CVE-2026-100349 is a NULL pointer dereference vulnerability in the kin-openapi library (github.com/getkin/kin-openapi) affecting versions up to 0.145.0. The issue occurs when a response header in an OpenAPI spec declares a 'content' field instead of a 'schema', causing the ValidateResponse function to panic due to a nil pointer dereference. This crash happens even though the document passes validation, leading to a process crash on every call to the affected operation. The vulnerability can cause denial of service if the spec is attacker-controlled or comes from an untrusted source.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.13.72. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2026:77319
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes
Security Fix(es):
None
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.13 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
web-pixels-manager@76.2.4 describes itself as a package for getting IP location and metadata. Its preinstall hook runs `node index.js` on npm install and requests `https://realwbx.com/ip.php?ip=8.8.8.8` with the hardcoded Authorization value `207e4133bd083b9e3e89c5556fc8677e`, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (2a75cc1a77f4f7dce3f84c9b66aa2613ace8bccab0fffa5587a4a30ce9fdc71a)
Package name `web-pixels-manager` typosquats Shopify's scoped `@shopify/web-pixels-manager`; the stated description (`get the IP location and metadata`) is unrelated to that name and the README is a one-line stub. `package.json` declares `preinstall: node index.js`, and `index.js` executes top-level code on `npm install` that performs an HTTPS GET to `https://realwbx.com/ip.php` with a hardcoded `Authorization` bearer token (via `getPublicIPLocation('8.8.8.8')`). The destination is not a Shopify or publisher-matching host. The install-time outbound call allows the operator of realwbx.com to enumerate hosts that installed the package, timestamp them, and correlate them to the hardcoded token, providing a victim check-in channel under a typosquatted name.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.18.57. See the following advisory for the container images for
this release:
https://access.redhat.com/errata/RHSA-2026:79039
Security Fix(es):
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of
Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.18 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.13.72. See the following advisory for the container images for
this release:
https://access.redhat.com/errata/RHSA-2026:77321
Security Fix(es):
None
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.13 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.100. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:77314
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
CVE-2026-107426 is a missing authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) that affects versions from 0 up to 7.5.12. The flaw involves incorrectly configured access control security levels, allowing unauthorized access. The vulnerability has a CVSS 3.1 score of 7.3, indicating high severity with network attack vector, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No patch or remediation information is provided in the source data.
CVE-2026-107421 is a session fixation vulnerability in VideoWhisper.com Broadcast Live Video software versions prior to 7.3.3. This flaw allows an attacker to hijack user sessions, potentially leading to unauthorized access. The vulnerability affects versions from initial releases up to 7.3.2. It has a CVSS 3.1 score of 7.3, indicating high severity with network attack vector and no required privileges or user interaction.
CVE-2026-107422 is a stored cross-site scripting (XSS) vulnerability in the WP w3all phpBB integration plugin for WordPress. It affects versions from initial release up to 3.1.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to inject malicious scripts that execute in the context of other users. The CVSS 3.1 base score is 6.5, indicating a medium severity level.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
A security advisory from Red Hat addresses multiple vulnerabilities affecting Red Hat AI Base Images 3.2.5 (Spyre), including CVE-2026-8461 and several others. One notable flaw is an integer overflow in FFmpeg's processing of Common Encryption (CENC) subsample data, which can lead to out-of-bounds writes causing information disclosure, data corruption, or denial of service. This vulnerability requires local processing of specially crafted media files and is rated moderate by Red Hat. No fixes are currently available for these issues in the Red Hat AI Base Images 3.2.5. Red Hat OpenShift AI and related products that bundle FFmpeg are affected, but the cloud.redhat.com ffmpeg component is not vulnerable. Red Hat is pursuing fixes through product streams.