CVE-2026-1289
published 2026-08-06CVE-2026-1289: A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability…
PriorityP342high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.19%
8.5th percentile
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| autodesk | autocad | >= 2024.0.0 < 2024.1.9 | 2024.1.9 |
| autodesk | autocad | >= 2025.0.0 < 2025.1.4 | 2025.1.4 |
| autodesk | autocad | >= 2026.0.0 < 2026.1.2 | 2026.1.2 |
| autodesk | autocad | >= 2027.0.0 < 2027.1.0 | 2027.1.0 |
| autodesk | autocad_lt | >= 2024.0.0 < 2024.1.9 | 2024.1.9 |
| autodesk | autocad_lt | >= 2025.0.0 < 2025.1.4 | 2025.1.4 |
| autodesk | autocad_lt | >= 2026.0.0 < 2026.1.2 | 2026.1.2 |
| autodesk | autocad_lt | >= 2027.0.0 < 2027.1.0 | 2027.1.0 |
| autodesk | dwg_trueview | >= 2024.0.0 < 2024.1.9 | 2024.1.9 |
| autodesk | dwg_trueview | >= 2025.0.0 < 2025.1.4 | 2025.1.4 |
| autodesk | dwg_trueview | >= 2026.0.0 < 2026.1.2 | 2026.1.2 |
| autodesk | dwg_trueview | >= 2027.0.0 < 2027.1.0 | 2027.1.0 |
| autodesk | revit | >= 2024 < 2024.3.6 | 2024.3.6 |
| autodesk | revit | >= 2024.0.0 < 2024.3.6 | 2024.3.6 |
| autodesk | revit | >= 2025 < 2025.4.6 | 2025.4.6 |
| autodesk | revit | >= 2025.0.0 < 2025.4.6 | 2025.4.6 |
| autodesk | revit | >= 2026 < 2026.5 | 2026.5 |
| autodesk | revit | >= 2026.0.0 < 2026.5.0 | 2026.5.0 |
| autodesk | revit | >= 2027 < 2027.2 | 2027.2 |
| autodesk | revit | >= 2027.0.0 < 2027.2.0 | 2027.2.0 |
| gitlab | gitlab | — | — |
| gitlab | gitlab_ce | — | — |
| parse-community | parse-dashboard | >= 7.3.0-alpha.42 < 9.0.0-alpha.8 | 9.0.0-alpha.8 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ghsa8.6HIGH
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
ghsa·2026-10-08·CVSS 8.6
CVE-2026-107289 [HIGH] CWE-1289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
### Summary
When an application using Pydantic AI opts a URL into local network access — either a `FileUrl` with `force_download='allow-local'`, or `web_fetch_tool(allow_local_urls=True)` — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address (for example `fd00:ec2::254%251`). The host ignores the zone identifier on a destination that is not link-local and delivers the request to the metadata endpoint anyway, exposing cloud IAM short-term credentials.
This is an incomplete fix of [GHSA-cqp8-fcvh-x7r3](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cqp8-fcvh-x7r3) / [CVE-2026-46678](https://nvd.nist.gov/vuln/detail/CVE-2026-46678) and [GHSA-cg
GHSA
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability.
ghsa_unreviewed·2026-08-07
CVE-2026-1289 [HIGH] CWE-416 A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability.
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
GHSA
Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
ghsa·2026-02-25
CVE-2026-27610 [HIGH] CWE-1289 Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
### Impact
The `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key.
### Patches
The fix uses distinct cache keys for master key and read-only master key.
### Workarounds
Avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration.
### Resources
- GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr
- Fixed in: https://github.com/parse-community/parse-dashboard/releases/
Red Hat
kernel: Bluetooth: hci_sock: reject out-of-range OCF values
vendor_redhat·2026-10-18·CVSS 4.4
CVE-2026-98460 [MEDIUM] CWE-1289 kernel: Bluetooth: hci_sock: reject out-of-range OCF values
kernel: Bluetooth: hci_sock: reject out-of-range OCF values
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sock: reject out-of-range OCF values
The raw HCI socket security filter has 128 OCF bits per supported OGF,
but masks the 10-bit OCF with 127 before looking up the command. An
unprivileged socket can therefore submit a reserved OCF that aliases an
allowlisted command modulo 128.
A conforming controller should reject reserved opcodes. Nevertheless,
the security decision must apply to the opcode that will actually be
sent, especially since controller-specific behavior is outside the host
stack's control.
Reject OCF values that cannot be represented by the security filter
instead of aliasing them onto an unrelated command.
A flaw was found in the Lin
Red Hat
rustls-webpki: rustls-webpki: Name Constraint Bypass in wildcard certificate validation
vendor_redhat·2026-09-18·CVSS 2.2
CVE-2026-93601 [LOW] CWE-1289 rustls-webpki: rustls-webpki: Name Constraint Bypass in wildcard certificate validation
rustls-webpki: rustls-webpki: Name Constraint Bypass in wildcard certificate validation
rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a certificate for *.example.com, which could feasibly assert reject.example.com — a name outside the permitted subtree. Because name constraints are restrictions applied to otherwise properly issued certificates, the issue is only reachable after signature verification succeeds and requires a misissued wildcard certificate to exploit.
A flaw was found in rustls-webpki. This component incorrectly processes DN
Red Hat
fastify: fastify: Header validation bypass via incomplete schema case normalization
vendor_redhat·2026-09-04·CVSS 7.5
CVE-2026-84428 [HIGH] CWE-1289 fastify: fastify: Header validation bypass via incomplete schema case normalization
fastify: fastify: Header validation bypass via incomplete schema case normalization
A flaw was found in fastify. Due to incomplete case normalization of HTTP header names within a route's header schema, specifically within the JSON Schema Draft 7 dependencies keyword, an unauthenticated remote attacker can bypass intended conditional checks. This allows the attacker to send headers that activate privileged functionality without providing the required authentication headers, leading to an authorization bypass.
Package: rhelai3/bootc-cuda-rhel9 (Red Hat Enterprise Linux AI (RHEL AI) 3) - Affected
Package: rhelai3/bootc-gaudi-rhel9 (Red Hat Enterprise Linux AI (RHEL AI) 3) - Affected
Package: rhelai3/bootc-rocm-rhel9 (Red Hat Enterprise Linux AI (RHEL AI) 3) - Affected
Package: rhelai3/d
Red Hat
fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies
vendor_redhat·2026-09-02·CVSS 7.5
CVE-2026-84394 [HIGH] CWE-1289 fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies
fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried
Red Hat
@backstage/plugin-auth-backend: Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
vendor_redhat·2026-08-13·CVSS 4.7
CVE-2026-73563 [MEDIUM] CWE-1289 @backstage/plugin-auth-backend: Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
@backstage/plugin-auth-backend: Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
A flaw was found in the `@backstage/plugin-auth-backend` component of Backstage. This vulnerability allows an unauthenticated remote attacker to bypass the `redirect_uri` allowlist in the experimental dynamic client registration feature. By crafting a malicious redirect Uniform Resource Identifier (URI) with a trusted hostname suffix, an attacker can receive an OAuth authorization code, potentially leading to an account takeover. This issue affects deployments that have enabled the experimental features and configured custom wildcard-hostname or protocol-less patterns.
Statement: Red Hat Developer Hub (RHDH) and Ansible Automation Portal ship @backstage/plugin-auth-backen
Red Hat
jupyterlab: jupyterlab: Extension blocklist bypass via weak package-name canonicalization
vendor_redhat·2026-08-13·CVSS 6.1
CVE-2026-73416 [MEDIUM] CWE-1289 jupyterlab: jupyterlab: Extension blocklist bypass via weak package-name canonicalization
jupyterlab: jupyterlab: Extension blocklist bypass via weak package-name canonicalization
A flaw was found in jupyterlab. The PyPI (Python Package Index) extension manager uses a custom normalization process for package names that is weaker than the official PyPI canonicalization. This allows an authenticated user to bypass blocklist restrictions by using an alternative spelling of a prohibited package name. Consequently, an attacker can install unauthorized extensions, compromise system integrity, and impact the availability of the JupyterLab environment.
Red Hat
loofah: Loofah: Cross-Site Scripting via malformed `javascript:` URI parsing
vendor_redhat·2026-08-12·CVSS 2.3
CVE-2026-73491 [LOW] CWE-1289 loofah: Loofah: Cross-Site Scripting via malformed `javascript:` URI parsing
loofah: Loofah: Cross-Site Scripting via malformed `javascript:` URI parsing
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references or
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
A flaw was found in Loofah. The `Loofah::HTM
Red Hat
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
vendor_redhat·2026-07-30·CVSS 9.0
CVE-2026-17806 [MEDIUM] CWE-1289 chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
An insufficient validation of untrusted input flaw was found in the Extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=516433058
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
vendor_redhat·2026-07-30·CVSS 7.5
CVE-2026-17930 [HIGH] CWE-1289 chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
An insufficient validation of untrusted input flaw was found in the Extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=513769158
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Mobile
vendor_redhat·2026-07-30·CVSS 4.4
CVE-2026-17860 [MEDIUM] CWE-1289 chromium-browser: chromium-browser: Insufficient validation of untrusted input in Mobile
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Mobile
An insufficient validation of untrusted input flaw was found in the Mobile component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=520407381
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in PageInfo
vendor_redhat·2026-06-30·CVSS 6.5
CVE-2026-14065 [MEDIUM] CWE-1289 chromium-browser: Insufficient validation of untrusted input in PageInfo
chromium-browser: Insufficient validation of untrusted input in PageInfo
Insufficient validation of untrusted input in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
An insufficient validation of untrusted input flaw was found in the PageInfo component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=503617508
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in UI
vendor_redhat·2026-06-30·CVSS 7.8
CVE-2026-13927 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in UI
chromium-browser: Insufficient validation of untrusted input in UI
Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)
An insufficient validation of untrusted input flaw was found in the UI component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=511826446
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in WebAppInstalls
vendor_redhat·2026-06-30·CVSS 7.5
CVE-2026-13794 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in WebAppInstalls
chromium-browser: Insufficient validation of untrusted input in WebAppInstalls
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
An insufficient validation of untrusted input flaw was found in the WebAppInstalls component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=513893425
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
caddy: github.com/caddyserver/caddy/v2: Caddy: Remote Code Execution via Unsafe Unicode Handling in FastCGI
vendor_redhat·2026-06-23·CVSS 8.1
CVE-2026-45135 [HIGH] CWE-1289 caddy: github.com/caddyserver/caddy/v2: Caddy: Remote Code Execution via Unsafe Unicode Handling in FastCGI
caddy: github.com/caddyserver/caddy/v2: Caddy: Remote Code Execution via Unsafe Unicode Handling in FastCGI
Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is
Red Hat
chromium-browser: Insufficient validation of untrusted input in Reader Mode
vendor_redhat·2026-06-02·CVSS 7.7
CVE-2026-11297 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Reader Mode
chromium-browser: Insufficient validation of untrusted input in Reader Mode
Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)
An insufficient validation of untrusted input flaw was found in the Reader Mode component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=502502017
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Password Manager
vendor_redhat·2026-06-02·CVSS 7.5
CVE-2026-11151 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Password Manager
chromium-browser: Insufficient validation of untrusted input in Password Manager
Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
An insufficient validation of untrusted input flaw was found in the Password Manager component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=501740323
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Chromoting
vendor_redhat·2026-06-02·CVSS 9.6
CVE-2026-11070 [CRITICAL] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Chromoting
chromium-browser: Insufficient validation of untrusted input in Chromoting
Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the network process to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)
An insufficient validation of untrusted input flaw was found in the Chromoting component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=499225384
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Enterprise Reporting
vendor_redhat·2026-06-02·CVSS 9.6
CVE-2026-11120 [CRITICAL] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Enterprise Reporting
chromium-browser: Insufficient validation of untrusted input in Enterprise Reporting
Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
An insufficient validation of untrusted input flaw was found in the Enterprise Reporting component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=501467566
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Media
vendor_redhat·2026-06-02·CVSS 8.8
CVE-2026-11046 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Media
chromium-browser: Insufficient validation of untrusted input in Media
Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
An insufficient validation of untrusted input flaw was found in the Media component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=498728857
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
vendor_redhat·2026-05-22·CVSS 9.6
CVE-2026-39821 [CRITICAL] CWE-1289 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
A flaw was found in the `idna` package, specifically within the `golang.org/x/net/idna` component. This
Red Hat
chromium-browser: chromium-browser: Insufficient validation of untrusted input in ReadingMode
vendor_redhat·2026-05-14·CVSS 3.1
CVE-2026-8536 [LOW] CWE-1289 chromium-browser: chromium-browser: Insufficient validation of untrusted input in ReadingMode
chromium-browser: chromium-browser: Insufficient validation of untrusted input in ReadingMode
Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass site Isolation via a crafted HTML page. (Chromium security severity: High)
An insufficient validation of untrusted input flaw was found in the ReadingMode component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=495857582
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in SiteIsolation
vendor_redhat·2026-05-05·CVSS 8.7
CVE-2026-7966 [MEDIUM] CWE-1289 chromium-browser: Insufficient validation of untrusted input in SiteIsolation
chromium-browser: Insufficient validation of untrusted input in SiteIsolation
An insufficient validation of untrusted input flaw was found in the SiteIsolation component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=497341787
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
vendor_redhat·2026-04-23·CVSS 6.8
CVE-2026-41239 [MEDIUM] CWE-1289 DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
A flaw was found in DOMPurify. A remote attacker could exploit this cross-site scripting (XSS) vulnerability when DOMPurify is configured to return a Document Object Model (DOM) or DOM fragment. The SAFE_FOR_TEMPLATES feature, intended to strip template expressions like {{...}}, fails in these modes, allowing malicious content to bypass sanitization. This can lead to arbitrary code execution or information disclosure in applications utilizing template-evaluating frameworks such as Vue 2.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability
Red Hat
fastify: Fastify: Schema validation bypass via malformed Content-Type header
vendor_redhat·2026-04-15·CVSS 7.5
CVE-2026-33806 [HIGH] CWE-1289 fastify: Fastify: Schema validation bypass via malformed Content-Type header
fastify: Fastify: Schema validation bypass via malformed Content-Type header
A flaw was found in Fastify. A remote attacker could exploit this vulnerability by prepending a space to the Content-Type header in a request. This action bypasses the application's schema validation, allowing the attacker to submit data that would otherwise be rejected. This could lead to unexpected data processing and potential integrity issues within the application.
Statement: This vulnerability doesn't affect any supported Red Hat product. This happens because or either the vulnerability was introduced in a version later than the shipped one or the product is already shipping a patched version of Fastify.
Package: rhelai3/bootc-cuda-rhel9 (Red Hat Enterprise Linux AI (RHEL AI) 3) - Not affected
Package: r
Red Hat
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
vendor_redhat·2026-04-08·CVSS 7.5
CVE-2026-33810 [HIGH] CWE-1289 crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate vali
Red Hat
chromium-browser: Insufficient validation of untrusted input in Downloads
vendor_redhat·2026-04-07·CVSS 4.3
CVE-2026-5887 [MEDIUM] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Downloads
chromium-browser: Insufficient validation of untrusted input in Downloads
An insufficient validation of untrusted input flaw was found in the Downloads component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=486079015
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
GitLab
CVE-2026-1094: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hi
vendor_gitlab·2026-02-11·CVSS 4.6
CVE-2026-1094 [MEDIUM] CWE-1289 CVE-2026-1094: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hi
CVE-2026-1094: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hide specially crafted file changes from the WebUI.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-06
Published