These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, l [truncated]
The GIMP image manipulation program is affected by a heap overflow vulnerability within its Seattle Filmworks file loader. This vulnerability, tracked as CVE-2026-59087, could allow a remote attacker to execute arbitrary code or cause a denial of service by tricking a user into opening a specially crafted Seattle Filmworks file. The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T10:17:32.250Z and has not been modified since then. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations in 389 Directory Server perform no authorization check. This allows an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enable [truncated]
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. This CVE record was published on 2026-08-10T03:16:40.380Z and has not been modified since then. Users and administrators of GStreamer-based applications, especially those processing untrusted media files, should be awar [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-08T16:16:49.093Z and has not been modified since then. This CVE-2026-42170 vulnerability involves a heap-based buffer overflow in the GIMP DDS file parser. A crafted DDS file can declare a D3D9 pixel format with a lower bits-per-pixel value, leading to an undersized heap buffer allocation. Subsequen [truncated]
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bo [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T07:16:29.413Z and has not been modified since then. The SAML broker component of Keycloak fails to enforce the OneTimeUse condition in SAML assertions, allowing an attacker to replay valid, unused assertions. This flaw could enable session hijacking and unauthorized access as the victim user. Key [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record for CVE-2026-44605 was published on 2026-08-05T18:17:11.173Z. This CVE record details a heap buffer overflow vulnerability in RPM Package Manager (RPM) when processing a specially crafted NDB database file. The vulnerability, which arises from an error in how RPM handles certain calculations during file parsing, leading to [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T16:16:57.330Z and has not been modified since then. This vulnerability affects openshift/oauth-proxy, specifically paths configured to bypass authentication (skip-auth-regex). An unauthenticated attacker can inject forged identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-T [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T16:16:52.027Z and has not been modified since then. The CVE-2026-16442 vulnerability is related to the SAML broker component of Keycloak. The issue arises from the IdP-initiated Single Sign-On endpoint not checking if a provider is restricted to account linking only. This oversight allows an atta [truncated]
The CVE-2026-15572 flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The 'Allowed Protocol Mapper Types' policy restricts which types of data mappers a client can use but fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. This allows an attacker with client registration privileges to exploit the vulnerabilit [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T15:16:37.573Z and has not been modified since then. This vulnerability affects Keycloak instances with metrics enabled, allowing authenticated users with low privileges to potentially exploit this flaw and cause a denial-of-service condition by creating a massive number of unique metric entries, [truncated]
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information f [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T15:16:36.397Z and has not been modified since then. This vulnerability affects Keycloak instances, particularly those with administrative or restricted areas. The PathMatcher component in Keycloak's Authorization Services does not properly normalize URIs before comparison, allowing attackers to t [truncated]
A flaw in the SAML metadata import functionality of the keycloak-services component in Red Hat Build of Keycloak allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier. The issue arises when importing identity provider metadata lacking specific usage attributes for keys, causing the system to incorrectly disable signa [truncated]
A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive. The issue arises from improper handling of AIO operations, al [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T13:24:47.223Z and has not been modified since then. The libkcapi library has a vulnerability in its one-shot AIO path, allowing for potential memory corruption via uncanceled AIO requests on error. Organizations using libkcapi should verify their inventory, assess potential impact, and review ven [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T13:24:47.087Z and has not been modified since then. This CVE-2026-71225 vulnerability affects libkcapi, a library used for cryptographic operations. The flaw occurs in one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaini [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T09:18:14.667Z and has not been modified since then. A flaw in the Application Subscription controller of Red Hat Advanced Cluster Management for Kubernetes (ACM) allows a user with namespace-scoped 'edit' privileges to create Channel and Subscription resources pointing to a controlled Helm reposi [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T09:18:13.720Z and has not been modified since then. This vulnerability, CVE-2026-10059, is a critical flaw in the Multicluster Engine for Kubernetes ClusterCurator controller. It allows a tenant administrator with namespace-scoped privileges to create a namespaced ClusterCurator, inadvertently gr [truncated]
A buffer overflow vulnerability exists in dhcp-server, which could allow a remote attacker to cause a persistent denial of service (DoS). The vulnerability is triggered by a specially crafted lease creation request containing an overly long InfiniBand MAC address, which causes the `print_hw_addr()` function to overflow. This results in the `dhcpd` service crashing and prevents it from restarting without m [truncated]
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T06:16:30.490Z and has not been modified since then. The vulnerability affects SSSD, specifically the sss_nss_protocol_fill_initgr() function in the NSS responder, which pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped. This causes uninitialize [truncated]
The CVE-2026-18739 record indicates an off-by-one error in the poptStuffArgs function of the popt library, which can lead to internal program data corruption. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data. The CVSS score is 2.5, with a LOW severity. Red Hat has a reference for this CVE. Affected product [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T06:16:30.140Z and has not been modified since then. The keycloak-services component of Red Hat Build of Keycloak has a flaw in its backchannel logout endpoint. When an OIDC identity provider is configured to skip signature validation, the system incorrectly accepts logout requests without cryptog [truncated]
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specia [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T03:16:25.537Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. This CVE-2026-17614 vulnerability involves a path traversal flaw in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods do not validate that the [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-03T17:16:33.897Z and has not been modified since then. This CVE-2026-18477 vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows local attackers with write access to influence the restore process. During restoration, files or directories may be created, renamed, or overwritten ou [truncated]
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account th [truncated]
The GNU tar vulnerability (CVE-2026-18508) is a critical issue that affects users extracting archives from untrusted sources. This flaw allows crafted archives to create hardlinks that escape the intended boundary when using the --one-top-level option, potentially leading to local attacks. Organizations should prioritize patching and implement compensating controls to prevent exploitation. System administ [truncated]
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service. This issue affects SSSD deployments, particularly those usin [truncated]
A flaw in the keycloak-services component of Keycloak allows an attacker with client management permissions to bypass security policies by creating a public client and updating it to a confidential client with weaker authentication. This issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper evaluation of [truncated]
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. The vulnerability could lead to unauthorized access to sensitive information or elevated privileges for the newly created [truncated]
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component of Red Hat Build of Keycloak. This issue allows a delegated user to bypass security policies by omitting the fullScopeAllowed field in a request, potentially leading to unauthorized role mappings and client creation with full scope access. Administrators and security teams managing Red Hat Build of Ke [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T16:17:05.387Z and has not been modified since then. This vulnerability in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA), allows an unauthenticated remote attacker to bypass mutual Transport Layer Security (mTLS) authentication for event streams by manipulati [truncated]
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID f [truncated]
A flaw in 389 Directory Server allows unauthenticated remote attackers to inject LDAP search filters into the CleanAllRUV replication status-check extended operation. This can lead to the extraction of sensitive server configuration metadata, including replication bind DNs and password storage scheme information. The CVE record was published on 2026-07-31T10:16:44.720Z and has not been modified since then [truncated]
A flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) allows a user with permission to create Deployments to set the openshift.io/encoded-deployment-config label to 'null', causing ACS to treat the workload as having empty UID, name, and labels, and namespace 'default'. This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central, and breaks v [truncated]
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a 'not-before' policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshin [truncated]
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate re [truncated]
The CVE record for CVE-2026-18214 was published on 2026-07-31T08:16:27.753Z. Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T08:16:27.610Z and has not been modified since then. The secure-client-uris client policy executor within Keycloak core services enforces security requirements on client configurations, such as requiring encrypted connections for redirect URIs. However, due to an improper check that only looks at [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T08:16:27.467Z and has not been modified since then. The flaw in the keycloak-services component of Keycloak allows attackers to inject duplicate security parameters into the login response by exploiting the security check's limitation to only inspect the query portion of a redirect URL and ignore [truncated]
A flaw in the Keycloak OIDC token introspection endpoint allows unauthorized clients to access sensitive information in tokens issued for different audiences. The endpoint correctly identifies tokens as inactive for certain clients but returns full token claims within a signed JWT field. This issue arises when confidential clients configured for signed JWT introspection responses attempt to introspect tok [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T08:16:27.010Z and has not been modified since then. This CVE-2026-18203 record details a flaw in Keycloak's group policy evaluation logic, allowing unauthorized access via a text-based prefix check vulnerability. The vulnerability occurs when a group policy is set to extend permissions to child g [truncated]
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T03:16:25.223Z and has not been modified since then. The vulnerability in yggdrasil-worker-package-manager allows local attackers to inject arguments in the APT backend through specially crafted package names starting with a hyphen, potentially leading to remote code execution with root privileges [truncated]
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if th [truncated]
An executive overview of CVE-2026-16527: This high-severity vulnerability affects the PCP pmproxy service, allowing an unauthenticated remote attacker to bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This could lead to arbitrary code execution and system takeover. System administrators and security teams should be aware of the potential impact and take immediate ac [truncated]
A flaw in Keycloak's client policy enforcement mechanism allows an attacker with client management privileges to potentially bypass security policies. The issue arises from group membership checks by name instead of a unique identifier, enabling an attacker to join a group with a matching name in a different part of the group hierarchy. This could allow unauthorized client registration or updates without [truncated]