These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A flaw in GStreamer's RealMedia demuxer can cause an application to crash, hang, or potentially read limited adjacent memory contents when processing a specially crafted RealMedia file. This vulnerability affects systems handling RealMedia files, particularly those using GStreamer's RealMedia demuxer, and may lead to application crashes, hangs, or memory exposure. Defenders should assess exposure and prio [truncated]
A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first chec [truncated]
CVE-2026-52722 is a HIGH severity vulnerability in GStreamer's VMnc decoder. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure. The vulnerability has a CVSS score of 7.1 and was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-52722).
CVE-2026-52721 is a MEDIUM-severity vulnerability with a CVSS score of 5.3. The vulnerability affects GStreamer's pcapparse element, which is primarily used in debugging pipelines. A local attacker could trick a user into processing a specially crafted PCAP file, potentially leading to a crash or information disclosure.
A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lea [truncated]
CVE-2026-52719 is an out-of-bounds read vulnerability found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The vulnerability occurs because the JPEG parser reads a segment length value from the bitstream without validating it against available data. This allows a remote attacker to trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input [truncated]
A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.
A flaw was found in Ansible Lightspeed, related to insufficient session expiration. This vulnerability allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backen [truncated]
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog mess [truncated]
A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.
CVE-2026-54229 is a HIGH-severity vulnerability with a CVSS score of 7. The vulnerability is caused by a race condition in the abrt-dbus D-Bus service's ChownProblemDir method. This method opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain [truncated]
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.
CVE-2026-48914 is a medium-severity vulnerability in QEMU's virtio-blk device. The device fails to properly validate the size of input descriptors before writing data, allowing a malicious guest with high privileges to submit a malformed virtio-blk SCSI request. This can lead to an out-of-bounds write in the host heap memory and potentially cause a denial of service (DoS) for the QEMU process.
A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond [truncated]
CVE-2026-53701 is a MEDIUM-severity vulnerability with a CVSS score of 6.5. The vulnerability was published on 2026-06-11T19:16:47.913Z and last modified on 2026-06-11T20:56:29.653Z. The vulnerability affects GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad, allowing an out-of-bounds write via a crafted H.266/VVC media file.
CVE-2026-11774 is a HIGH severity vulnerability in the SASL I/O layer of 389 Directory Server (389-ds-base). An integer overflow flaw was found in sasl_io_start_packet(), which can cause a heap buffer overflow of up to approximately 2 megabytes of attacker-controlled data after a successful SASL bind with integrity protection. This can lead to a Denial of Service (DoS) or achieve Remote Code Execution (RC [truncated]
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting [truncated]
CVE-2026-11850 is an integer underflow vulnerability in the MIT krb5 implementation, specifically in the `berval2tl_data()` function located in `plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c`. The function performs an unsigned subtraction (`bv_len - 2`) without a prior bounds check. When `bv_len` is 0 or 1, the subtraction wraps to a large value, which is then truncated to `uint16_t`, yielding 0xFFFE (65 [truncated]
A flaw in dracut allows remote attackers on the adjacent network to exploit the vulnerability by providing specially crafted DHCP options, potentially leading to root code execution within the initramfs. The vulnerability is caused by improper handling of DHCP options, which can be exploited by providing malicious hostname or other options. This can lead to command injection and potentially compromise the [truncated]
CVE-2026-53476 is a critical path traversal vulnerability in assisted-migration-agent. An unauthenticated attacker on the same LAN can exploit this flaw to bypass security checks and write arbitrary files to the system, potentially leading to unauthorized code execution.
CVE-2026-53475 is a critical vulnerability in assisted-migration-agent, with a CVSS score of 9.3. The application hardcodes insecure TLS connections when communicating with vCenter, allowing a Man-in-the-Middle (MITM) attacker to intercept and harvest vCenter administrator credentials. This can lead to unauthorized access to vCenter.
A critical SQL Injection vulnerability was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing [truncated]
A cross-site scripting (XSS) vulnerability was discovered in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link in the user interface, the embedded malicious code executes within the user's browser session. This vulnerability allows the attacker to compromise the vict [truncated]
A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete [truncated]
CVE-2026-53470: A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensit [truncated]
CVE-2026-11884 is a heap buffer overflow vulnerability in 389 Directory Server. The vulnerability occurs when serializing objectclass definitions, where the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat(). An attacker with Directory Manager privileges, or a compromised replication supplier, [truncated]
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the a [truncated]
CVE-2026-11790 is a medium-severity vulnerability in 389 Directory Server's PBKDF2-SHA256 password storage plugin. The plugin fails to enforce an upper bound on the iteration count extracted from stored password hashes, allowing a privileged attacker to cause excessive CPU consumption during authentication, resulting in denial of service. The vulnerability was published on [cvePublishedAt] and modified on [truncated]
CVE-2026-11789 is a MEDIUM-severity vulnerability affecting 389 Directory Server. The SMD5 password storage plugin is vulnerable to an unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes. This causes a buffer over-read that crashes the LDAP server during authentication.
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.