CVE-2026-1289
published 2026-08-06CVE-2026-1289: A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability…
PriorityP342high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.14%
3.9th percentile
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| autodesk | revit | >= 2026.0.0 < 2026.5.0 | 2026.5.0 |
| autodesk | revit | >= 2027.0.0 < 2027.2.0 | 2027.2.0 |
| github.com | dunglas_mercure | >= 0 < 0.22.0 | 0.22.0 |
| gitlab | gitlab | — | — |
| gitlab | gitlab_ce | — | — |
| parse-community | parse-dashboard | >= 7.3.0-alpha.42 < 9.0.0-alpha.8 | 9.0.0-alpha.8 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ghsa5.1MEDIUM
vendor_redhat9.9CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability.
ghsa_unreviewed·2026-08-07
CVE-2026-1289 [HIGH] CWE-416 A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability.
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
GHSA
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
ghsa·2026-06-04
CVE-2026-47674 [MEDIUM] CWE-1289 Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
### Summary
The `ip-restriction` middleware (`hono/ip-restriction`) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the rule to be silently skipped.
### Details
When the rule matcher is built, each configured IP rule is normalized to a canonical string form. Incoming IP addresses received at request time are then compared against those canonical strings without applying the same normalization. Because IPv6 permits multiple syntac
GHSA
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
ghsa·2026-05-28·CVSS 5.1
CVE-2026-46644 [MEDIUM] CWE-1289 symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
### Description
`symfony/polyfill-intl-idn` provides a userland implementation of `idn_to_utf8()` and `idn_to_ascii()` for runtimes that lack the `intl` extension. Its `Idn::process()` method decodes labels prefixed with `xn--` using Punycode but never enforces the validity criterion added in UTS #46 revision 33 Section 4 step 4.1.2: after a successful Punycode decode, the result must contain at least one non-ASCII code point.
As a consequence, `xn--` labels whose Punycode payload is empty (`xn--`) or decodes to a string made of only ASCII code points (e.g. `xn--kc1zs4-`) are accepted by the polyfill while PHP's native `ext-intl` rejects them with `IDNA_ERROR_INVALID_
GHSA
mercure has Topic Selector Cache Key Collision
ghsa·2026-04-08
CVE-2026-39972 [HIGH] CWE-1289 mercure has Topic Selector Cache Key Collision
mercure has Topic Selector Cache Key Collision
### Impact
A cache key collision vulnerability in `TopicSelectorStore` allows an attacker to poison the match result cache, potentially causing private updates to be delivered to unauthorized subscribers or blocking delivery to authorized ones.
The cache key was constructed by concatenating the topic selector and topic with an underscore separator:
```go
k = "m_" + topicSelector + "_" + topic
```
Because both topic selectors and topics can contain underscores, two distinct pairs can produce the same key:
```
selector="foo_bar" topic="baz" → key: "m_foo_bar_baz"
selector="foo" topic="bar_baz" → key: "m_foo_bar_baz"
```
An attacker who can subscribe to the hub or publish updates with crafted topic names can exploit this to bypass authoriz
GHSA
Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
ghsa·2026-02-25
CVE-2026-27610 [HIGH] CWE-1289 Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
### Impact
The `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key.
### Patches
The fix uses distinct cache keys for master key and read-only master key.
### Workarounds
Avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration.
### Resources
- GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr
- Fixed in: https://github.com/parse-community/parse-dashboard/releases/
Red Hat
jupyterlab: jupyterlab: Extension blocklist bypass via weak package-name canonicalization
vendor_redhat·2026-08-13·CVSS 6.1
CVE-2026-73416 [MEDIUM] CWE-1289 jupyterlab: jupyterlab: Extension blocklist bypass via weak package-name canonicalization
jupyterlab: jupyterlab: Extension blocklist bypass via weak package-name canonicalization
A flaw was found in jupyterlab. The PyPI (Python Package Index) extension manager uses a custom normalization process for package names that is weaker than the official PyPI canonicalization. This allows an authenticated user to bypass blocklist restrictions by using an alternative spelling of a prohibited package name. Consequently, an attacker can install unauthorized extensions, compromise system integrity, and impact the availability of the JupyterLab environment.
Red Hat
loofah: Loofah: Cross-Site Scripting via malformed `javascript:` URI parsing
vendor_redhat·2026-08-12·CVSS 2.3
CVE-2026-73491 [LOW] CWE-1289 loofah: Loofah: Cross-Site Scripting via malformed `javascript:` URI parsing
loofah: Loofah: Cross-Site Scripting via malformed `javascript:` URI parsing
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references or
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
A flaw was found in Loofah. The `Loofah::HTM
Red Hat
org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
vendor_redhat·2026-08-06·CVSS 4.7
CVE-2026-71497 [MEDIUM] CWE-1289 org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup after serialization. This could allow a remote attacker to achieve cross-site scripting (XSS).
Statement: This cross-site scripting flaw in jsoup requires a custom `Safelist` that explicitly allows raw-text elements, which is not a default configuration. Exploitation is limited to applications processing untrusted HTML with such a permissive custom `Safelist`, reducing the overall risk.
Package: jsoup (Cryostat 4) - Fix de
Red Hat
fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
vendor_redhat·2026-07-31·CVSS 7.5
CVE-2026-18446 [HIGH] CWE-1289 fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers (URIs) when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion. A remote attacker could exploit this to bypass security policies, such as allowlists or Server-Side Request Forgery (SSRF) filters, potentially redirecting applications to unintended hosts.
Package: cryostat-openshift-console-plugin-npm (Cryostat 4) - Under investigation
Package: grafana-infinity-datasource-npm (Cryostat 4) - Under investigation
Package: mta/mta-solution-server-rhel9 (Migration Toolkit for Appli
Red Hat
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
vendor_redhat·2026-07-30·CVSS 9.0
CVE-2026-17806 [MEDIUM] CWE-1289 chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
An insufficient validation of untrusted input flaw was found in the Extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=516433058
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
vendor_redhat·2026-07-30·CVSS 7.5
CVE-2026-17930 [HIGH] CWE-1289 chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions
An insufficient validation of untrusted input flaw was found in the Extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=513769158
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Mobile
vendor_redhat·2026-07-30·CVSS 4.4
CVE-2026-17860 [MEDIUM] CWE-1289 chromium-browser: chromium-browser: Insufficient validation of untrusted input in Mobile
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Mobile
An insufficient validation of untrusted input flaw was found in the Mobile component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=520407381
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Safe Browsing
vendor_redhat·2026-07-30·CVSS 5.4
CVE-2026-17799 [MEDIUM] CWE-1289 chromium-browser: chromium-browser: Insufficient validation of untrusted input in Safe Browsing
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Safe Browsing
An insufficient validation of untrusted input flaw was found in the Safe Browsing component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=514461031
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in PageInfo
vendor_redhat·2026-06-30·CVSS 6.5
CVE-2026-14065 [MEDIUM] CWE-1289 chromium-browser: Insufficient validation of untrusted input in PageInfo
chromium-browser: Insufficient validation of untrusted input in PageInfo
Insufficient validation of untrusted input in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
An insufficient validation of untrusted input flaw was found in the PageInfo component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=503617508
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in UI
vendor_redhat·2026-06-30·CVSS 7.8
CVE-2026-13927 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in UI
chromium-browser: Insufficient validation of untrusted input in UI
Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)
An insufficient validation of untrusted input flaw was found in the UI component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=511826446
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in WebAppInstalls
vendor_redhat·2026-06-30·CVSS 7.5
CVE-2026-13794 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in WebAppInstalls
chromium-browser: Insufficient validation of untrusted input in WebAppInstalls
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
An insufficient validation of untrusted input flaw was found in the WebAppInstalls component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=513893425
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Dawn
vendor_redhat·2026-06-30·CVSS 8.3
CVE-2026-14428 [HIGH] CWE-1289 chromium-browser: chromium-browser: Insufficient validation of untrusted input in Dawn
chromium-browser: chromium-browser: Insufficient validation of untrusted input in Dawn
Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
An insufficient validation of untrusted input flaw was found in the Dawn component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=520180257
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Chromecast
vendor_redhat·2026-06-30·CVSS 9.6
CVE-2026-13797 [CRITICAL] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Chromecast
chromium-browser: Insufficient validation of untrusted input in Chromecast
Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
An insufficient validation of untrusted input flaw was found in the Chromecast component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=499025645
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
vendor_redhat·2026-06-25·CVSS 5.5
CVE-2026-53221 [MEDIUM] CWE-1289 kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
A flaw was found in the Linux kernel, specifically within the `ip6_vti` component responsible for managing IPv6 tunnels. This vulnerability arises from an error in the `vti6_tnl_lookup()` function, which incorrectly matches network tunnels by failing to properly verify wildcard addresses during fallback searches. This can lead to network traffic being misdirected or dropped, potentially disrupting network services. The underlying cause is a lack of checks to confirm that a candidate tunnel indeed has a wildcard address.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Reader Mode
vendor_redhat·2026-06-02·CVSS 7.7
CVE-2026-11297 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Reader Mode
chromium-browser: Insufficient validation of untrusted input in Reader Mode
Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)
An insufficient validation of untrusted input flaw was found in the Reader Mode component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=502502017
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Password Manager
vendor_redhat·2026-06-02·CVSS 7.5
CVE-2026-11151 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Password Manager
chromium-browser: Insufficient validation of untrusted input in Password Manager
Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
An insufficient validation of untrusted input flaw was found in the Password Manager component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=501740323
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Chromoting
vendor_redhat·2026-06-02·CVSS 9.6
CVE-2026-11070 [CRITICAL] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Chromoting
chromium-browser: Insufficient validation of untrusted input in Chromoting
Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the network process to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)
An insufficient validation of untrusted input flaw was found in the Chromoting component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=499225384
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Enterprise Reporting
vendor_redhat·2026-06-02·CVSS 9.6
CVE-2026-11120 [CRITICAL] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Enterprise Reporting
chromium-browser: Insufficient validation of untrusted input in Enterprise Reporting
Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
An insufficient validation of untrusted input flaw was found in the Enterprise Reporting component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=501467566
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Media
vendor_redhat·2026-06-02·CVSS 8.8
CVE-2026-11046 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Media
chromium-browser: Insufficient validation of untrusted input in Media
Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
An insufficient validation of untrusted input flaw was found in the Media component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=498728857
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in InterestGroups
vendor_redhat·2026-06-02·CVSS 8.3
CVE-2026-10970 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in InterestGroups
chromium-browser: Insufficient validation of untrusted input in InterestGroups
Insufficient validation of untrusted input in InterestGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
An insufficient validation of untrusted input flaw was found in the InterestGroups component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=512772489
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in Input
vendor_redhat·2026-05-27·CVSS 5.0
CVE-2026-9979 [MEDIUM] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Input
chromium-browser: Insufficient validation of untrusted input in Input
An insufficient validation of untrusted input flaw was found in the Input component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=511742228
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in OptimizationGuide
vendor_redhat·2026-05-27·CVSS 4.2
CVE-2026-9986 [MEDIUM] CWE-1289 chromium-browser: Insufficient validation of untrusted input in OptimizationGuide
chromium-browser: Insufficient validation of untrusted input in OptimizationGuide
An insufficient validation of untrusted input flaw was found in the OptimizationGuide component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=513028160
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
starlette: Starlette: Security restriction bypass via malformed HTTP Host header
vendor_redhat·2026-05-26·CVSS 6.5
CVE-2026-48710 [MEDIUM] CWE-1289 starlette: Starlette: Security restriction bypass via malformed HTTP Host header
starlette: Starlette: Security restriction bypass via malformed HTTP Host header
A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.
Package: exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 (Exploit Intelligence) - Affected
Package: mta/mta-solution-server-rhel9 (Migration Toolkit for Applicat
Red Hat
golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
vendor_redhat·2026-05-22·CVSS 9.6
CVE-2026-39821 [CRITICAL] CWE-1289 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
A flaw was found in the `idna` package, specifically within the `golang.org/x/net/idna` component. This
Red Hat
chromium-browser: chromium-browser: Insufficient validation of untrusted input in ReadingMode
vendor_redhat·2026-05-14·CVSS 3.1
CVE-2026-8536 [LOW] CWE-1289 chromium-browser: chromium-browser: Insufficient validation of untrusted input in ReadingMode
chromium-browser: chromium-browser: Insufficient validation of untrusted input in ReadingMode
Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass site Isolation via a crafted HTML page. (Chromium security severity: High)
An insufficient validation of untrusted input flaw was found in the ReadingMode component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=495857582
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping
vendor_redhat·2026-05-07·CVSS 6.1
CVE-2026-39826 [MEDIUM] CWE-1289 html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping
html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping
If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block.
A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user's browser.
Mitigation: Mitigation for this issue is either not available or the currently available option
Red Hat
chromium-browser: Insufficient validation of untrusted input in SiteIsolation
vendor_redhat·2026-05-05·CVSS 8.7
CVE-2026-7966 [MEDIUM] CWE-1289 chromium-browser: Insufficient validation of untrusted input in SiteIsolation
chromium-browser: Insufficient validation of untrusted input in SiteIsolation
An insufficient validation of untrusted input flaw was found in the SiteIsolation component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=497341787
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Insufficient validation of untrusted input in ChromeDriver
vendor_redhat·2026-05-05·CVSS 8.8
CVE-2026-8000 [HIGH] CWE-1289 chromium-browser: Insufficient validation of untrusted input in ChromeDriver
chromium-browser: Insufficient validation of untrusted input in ChromeDriver
An insufficient validation of untrusted input flaw was found in the ChromeDriver component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=494464734
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
vendor_redhat·2026-04-23·CVSS 6.8
CVE-2026-41239 [MEDIUM] CWE-1289 DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
A flaw was found in DOMPurify. A remote attacker could exploit this cross-site scripting (XSS) vulnerability when DOMPurify is configured to return a Document Object Model (DOM) or DOM fragment. The SAFE_FOR_TEMPLATES feature, intended to strip template expressions like {{...}}, fails in these modes, allowing malicious content to bypass sanitization. This can lead to arbitrary code execution or information disclosure in applications utilizing template-evaluating frameworks such as Vue 2.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability
Red Hat
fastify: Fastify: Schema validation bypass via malformed Content-Type header
vendor_redhat·2026-04-15·CVSS 7.5
CVE-2026-33806 [HIGH] CWE-1289 fastify: Fastify: Schema validation bypass via malformed Content-Type header
fastify: Fastify: Schema validation bypass via malformed Content-Type header
A flaw was found in Fastify. A remote attacker could exploit this vulnerability by prepending a space to the Content-Type header in a request. This action bypasses the application's schema validation, allowing the attacker to submit data that would otherwise be rejected. This could lead to unexpected data processing and potential integrity issues within the application.
Statement: This vulnerability doesn't affect any supported Red Hat product. This happens because or either the vulnerability was introduced in a version later than the shipped one or the product is already shipping a patched version of Fastify.
Package: rhelai3/bootc-cuda-rhel9 (Red Hat Enterprise Linux AI (RHEL AI) 3) - Not affected
Package: r
Red Hat
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
vendor_redhat·2026-04-08·CVSS 7.5
CVE-2026-33810 [HIGH] CWE-1289 crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate vali
Red Hat
chromium-browser: Insufficient validation of untrusted input in Downloads
vendor_redhat·2026-04-07·CVSS 4.3
CVE-2026-5887 [MEDIUM] CWE-1289 chromium-browser: Insufficient validation of untrusted input in Downloads
chromium-browser: Insufficient validation of untrusted input in Downloads
An insufficient validation of untrusted input flaw was found in the Downloads component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=486079015
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
GitLab
CVE-2026-1094: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hi
vendor_gitlab·2026-02-11·CVSS 4.6
CVE-2026-1094 [MEDIUM] CWE-1289 CVE-2026-1094: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hi
CVE-2026-1094: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hide specially crafted file changes from the WebUI.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-06
Published