These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A flaw in Keycloak, when deployed in stateless mode with MySQL or MariaDB, allows an attacker to bypass replay protection by exploiting a mismatch in row-count semantics between the database driver and Keycloak's application logic. This enables the attacker to reuse single-use security artifacts like JWT client assertions, DPoP proofs, or one-time password codes, potentially granting unauthorized access t [truncated]
A flaw in libxml2 can cause a Denial of Service (DoS) when parsing a specially crafted XML catalog. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to a NULL pointer dereference and application crash. The vulnerability affects systems and applications using libxml2 for XML catalog parsing, particularly those handling untrusted XML catalog inputs. Defenders respons [truncated]
A Denial of Service (DoS) vulnerability was found in quarkus-websockets-next, which allows a remote attacker to cause a crash by streaming messages over a single connection faster than the application can process them, leading to a java.lang.OutOfMemoryError. This vulnerability can be triggered by sending a large number of messages in a short period, causing the application to run out of heap space and re [truncated]
A flaw in SmallRye JWT's AwsAlbKeyResolver allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint, potentially reading non-public endpoints or internal data before JWT signature verification. This vulnerability arises from the direct concatenation of the attacker-controlled kid header value from a [truncated]
CVE-2026-92904 debrief based on CVE Program and NVD records. The foreman_remote_execution plugin has a flaw in its template invocations controller, allowing authenticated users with restricted job invocation visibility to enumerate job invocation IDs and access live output, rendered script, and input values for other users' job invocations within their own organizations. This medium-severity vulnerability [truncated]
A flaw in Redis community's cluster bus packet parser allows remote attackers to craft malicious packets, potentially leading to sensitive information disclosure or remote denial of service (DoS). The vulnerability, identified as CVE-2026-92925, stems from improper validation of string-carrying extensions for null-termination. This oversight enables attackers to exploit the system, emphasizing the need fo [truncated]
CVE-2026-92893 debrief based on CVE Program and NVD records. The foreman_ansible plugin's Ansible inventory API has a flaw allowing authenticated users with restricted host visibility to access full Ansible inventory for arbitrary host IDs, potentially impacting confidentiality. Defenders and administrators should assess exposure and verify inventory checks for restricted host visibility. This issue affec [truncated]
An authenticated user with the edit_ansible_variables permission can delete any LookupValue by ID, including override values for Ansible variables outside their permission filter scope and override values belonging to Puppet smart class parameters due to a flaw in the foreman_ansible plugin's Ansible override values API. This could lead to unauthorized changes in Ansible variable management and Puppet sma [truncated]
A flaw in flatpak-builder allows an attacker to execute arbitrary code with the privileges of the user running flatpak-builder during the build process by providing a malicious source with a Git post-applypatch hook when use-git-am: true is set. This occurs because Git hooks are not disabled when applying patch sources with use-git-am: true. The vulnerability can be exploited by providing a malicious sour [truncated]
A flaw in quay-builder-qemu allows remote attackers to exploit the upstream `Noelware/docker-manifest-action` by compromising its mutable branch, injecting arbitrary code, and exfiltrating sensitive registry credentials or publishing malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise. This vulnerability affects deployments relying on quay-builde [truncated]
A flaw in sequoia-openpgp allows an attacker to bypass the back-signature check, enabling illegitimate binding of an arbitrary subkey to their certificate and forging signatures, compromising cryptographic integrity. This vulnerability affects systems using sequoia-openpgp for cryptographic operations, particularly those with older certificates lacking key flags subpackets. Defenders should assess exposur [truncated]
A flaw in Keycloak's policy enforcer allows an authenticated user to trick the enforcer into applying a less restrictive security policy than intended by exploiting special encoded characters in web addresses, potentially gaining unauthorized access to sensitive administrative or private application endpoints. This issue arises from the enforcer's failure to correctly normalize web addresses containing sp [truncated]
A flaw in environment-modules allows a local attacker to execute arbitrary commands by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. This impacts confidentiality, integrity, and availability when the victim uses Bash completion for module or ml commands. The vulnerability is due to improper handling of module names, allowing attackers to inject malicious commands [truncated]
A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies, causing the multipathd listener thread to block and leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. The vulnerability affects multipathd installations and requires verification [truncated]
A flaw was found in libtiff, specifically in the `tiff2pdf` utility, which is vulnerable to a heap-buffer overflow due to an integer truncation error when processing crafted BigTIFF files. This issue can lead to a crash and severe memory corruption if an attacker provides a specially crafted BigTIFF file. The vulnerability exists because a 64-bit `StripByteCounts` value is truncated to a 32-bit integer, l [truncated]
A flaw in Keycloak's Dynamic Client Registration service allows users with the view-clients role to retrieve client details, including confidential secrets in cleartext. This could enable read-only administrators to gain full access to affected client accounts and potentially escalate privileges within the realm. The issue arises from a failure to mask sensitive information, allowing the client's confiden [truncated]
A local attacker with access to the swtpm account can exploit a symlink-following flaw in libvirt's qemuTPMEmulatorPrepareHost() function to transfer ownership of an arbitrary file to the swtpm user, potentially leading to elevation of privileges and data compromise. This vulnerability is particularly concerning because it allows a local attacker to manipulate file ownership, which could be used to gain f [truncated]
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.
A flaw in GStreamer's gst-plugins-good isomp4 plugin can lead to an out-of-bounds heap read when processing specially crafted MP4 or MOV files containing CEA-608 closed-caption data. This could result in disclosure of adjacent heap memory or application crash if an attacker tricks a user into opening a malicious media file. The vulnerability has medium severity and should be addressed, especially in syste [truncated]
A flaw in crun allows a container's stdio to be attached to a host file after pivot_root, potentially changing the file's ownership. This issue affects crun versions 1.29.1 and earlier. Default configurations with a fresh /dev mount are not vulnerable. No fixed release is available yet. The vulnerability arises from reopening /dev/null for stdio, which can follow a symlink and attach a host file to contai [truncated]
A flaw in crun allows terminal setup to redirect /dev/console onto an attacker-controlled path when /dev is not dedicatedly mounted in the container configuration. This issue affects crun versions 1.29.1 and earlier. Default configurations with a fresh /dev mount are not exposed. No fixed release is available yet. The issue arises from the container configuration not giving /dev a dedicated mount, allowin [truncated]
A flaw in crun allows execution of attacker-controlled payloads with host root privileges when built with libkrun and used with passt networking in rootful containers. This issue is a regression in crun 1.29, affecting versions >= 1.29. The vulnerability is a result of crun's interaction with libkrun and passt networking, which enables the execution of attacker-controlled payloads from the container image [truncated]
A flaw in the skupper-router component of Red Hat Service Interconnect can cause a denial of service due to a stack memory crash when processing specially crafted network messages. The issue arises from a lack of bounds on recursion during AMQP field parsing, which can lead to a crash and disrupt interconnected networks. Defenders should assess exposure and prioritize patching to prevent potential denial [truncated]
A flaw in bubblewrap allows creating files or directories outside the sandbox via a parent symlink, writing attacker-chosen paths as the launching user before the sandboxed process starts. This issue is fixed in bubblewrap 0.12.0. The vulnerability can lead to potential sandbox escape and unauthorized file creation. Defenders managing systems using bubblewrap for sandboxing should verify exposure and appl [truncated]
A flaw in the key provider component of the keycloak-services library allows a realm administrator to submit arbitrary filesystem paths as keystore parameters. This can potentially expose sensitive system information by determining the existence and readability of files on the server. Keycloak administrators should assess their deployments, verify and restrict inputs, and monitor for potential disclosure [truncated]
A flaw in gdk-pixbuf allows remote attackers to cause a heap out-of-bounds read via a specially crafted Apple Icon Image (.icns) file, potentially leading to denial of service or information disclosure. The vulnerability is in the uncompress() function handling RLE-encoded ICNS icon data. Defenders should assess exposure, particularly for systems handling .icns files, and review gdk-pixbuf library usage i [truncated]
A flaw in hawtio-operator allows a malicious tenant to obtain OpenShift access tokens of any cluster user who visits a crafted authorization URL without consent. The vulnerability arises from the operator creating a cluster-scoped OAuthClient with automatic grant approval and no client secret. This enables an attacker to register an arbitrary hostname as a valid OAuth redirect target. The issue impacts Op [truncated]
The gnome-tweaks shell theme installer does not validate ZIP archive member paths, allowing crafted archives to write files outside ~/.themes via path traversal, absolute paths, or symlinks. This vulnerability can lead to unauthorized file writes, elevation of privileges, or data tampering. System administrators and users of gnome-tweaks should assess exposure and prioritize remediation, especially when u [truncated]
A flaw in Dogtag PKI used by FreeIPA's certificate authority allows authenticated users with CA Administrator privileges to execute arbitrary commands as the pkiuser account via the ExternalProcessConstraint mechanism. This CVE was published on 2026-09-08T08:17:12.020Z and has not been modified since then. The vulnerability arises from insufficient validation of uploaded profile content in the certificate [truncated]
A flaw in GLib2's g_file_replace() function allows a local attacker to redirect writes to another file when creating a temporary file fails. This issue has a CVSS score of 5.3 and is classified as MEDIUM severity. The vulnerability arises when g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, leading to a race condition that can be [truncated]