A DOM-based cross-site scripting flaw in the Crawl4AI Playground UI (versions before 0.9.3) lets attacker-controlled crawled content — for example a malicious page title — be re-parsed as HTML inside the forceHighlightElement() routine, which writes textContent back into innerHTML. Because the Playground stores the operator's API token in sessionStorage, a successful payload can read that token and hand an attacker full control of the underlying Crawl4AI server. Exploitation requires the operator to load attacker-controlled page content in the Playground and trigger the highlight action; no public exploit code or CISA KEV entry is confirmed in the supplied intelligence, and the vendor has released a fix in 0.9.3.
Let me synthesize. CVE-2026-91942: crawl4ai before 0.9.3, DOM-based XSS in Docker Playground UI, innerHTML assignment of untrusted crawl results. Malicious PDFs with event-handler markup execute JS in Playground origin, steal API tokens from sessionStorage. CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N — score 5.1. UI:A means user interaction active (user must open the PDF in the playground). Subsequent system impacts limited (SC:L/SI:L). PR:N unauthenticated. Wait — description says "steal API tokens from sessionStorage for authenticated API abuse" — the attacker themselves may be unauthenticated but the victim is an authenticated user. PR:N with UI:A. Let me construct fields. product_name: "Crawl4AI" (2 words? one token). Fine. prevalence: crawl4ai is a popular open-source LLM-friendly web crawler — medium? It's fairly widely used in AI/RAG pipelines. It's a Python library with ~40k GitHub stars. Deployment footprint: medium. Docker Playground UI is a specific deployment mode though — that reduces. I'd say "medium" with basis "popular open-source LLM crawler; Playground UI subset narrower". Hmm, but the specific vulnerable component (Docker Playground UI) is niche. But prevalence is about the product. crawl4ai is popular open-source library. Medium seems fair. assessed_cvss_vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — scope changed because it impacts the Playground origin / API tokens (sessionStorage tokens, the script executes in the Playground origin). Actually the CVSS 4.0 vector shows SC:L/SI:L which implies subsequent system impacts → in 3.1 that maps to S:C with C:L/I:L. Hmm, but is scope change right? The vulnerable component is the Playground UI; the impacted component is... the API tokens / authenticated API. The XSS executes in the Playground origin — same origin. Stealing sessionStorage tokens then abusing the API — the API is arguably a different security authority. Given the CVSS 4.0 has subsequent-sys
Failed authentication attempts against MISP 2.5.45 and earlier stop being written to the audit log whenever the Redis instance used for log throttling is unreachable, and they remain unwritten for the entire duration of the outage. The flaw is in AppController::_shouldLog(), which treats 'Redis returned false' as 'nothing to log' rather than degrading to verbose logging, so brute-force or credential-stuffing activity against the login endpoint silently disappears from the record. No public exploit code and no CISA KEV entry exist for this issue, and the vendor shipped a fix in MISP 2.5.46 via commit a39b25d2f.
Stored cross-site scripting in the Netcore NR255-V router (firmware 1.5.130703) lets an authenticated administrator persist malicious JavaScript inside a QoS rule name, which the qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi and qos_filter_show_cgi handlers later pass to eval() without sanitisation. The injected script runs in the browser of any administrator who subsequently opens the affected QoS pages, allowing session theft, credential capture, or silent reconfiguration of the device through the victim's authenticated session. No public exploit code or active exploitation has been confirmed from the available intelligence.
Stored cross-site scripting in Netcore NR255-V firmware 1.5.130703 lets an authenticated administrator plant malicious JavaScript through the router's DDNS configuration, which then executes persistently every time the DDNS WAN list page (ddns_wan_list_show.cgi) is opened. The flaw stems from unsafe eval() handling of DDNS-supplied data in that CGI endpoint, so the injected payload is saved with the device configuration and survives page reloads and reboots. Confidentiality and integrity impact are rated low and no public exploit code has been identified at time of analysis, though the VulnCheck advisory and a public reference write-up are available.
Cookie attribute injection in http4s's ResponseCookie.render allows any application that builds a response cookie from unvalidated input to emit attacker-controlled Domain, Path, or SameSite attributes — widening cookie scope or stripping protections — while embedded control characters can enable HTTP header splitting on permissive backends. All applications using http4s versions before 0.23.35 or 1.0.0-M47 that feed untrusted data into the name, content, domain, path, or extension fields of a ResponseCookie are in scope. No public exploit code and no active exploitation were identified at time of analysis, and the moderate CVSS base of 4.8 reflects the high-complexity precondition that the consuming application must itself pass unsanitized input into the cookie constructor.
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the reserved names 'to', 'subject' and 'body' while they are still percent-encoded, then decodes them only when storing them as generic headers — so a percent-encoded spelling of a reserved field is invisible to that check but is written back out as the literal field name during serialization. Any application built on Fastify, ajv or similar Node.js stacks that parses a mailto URI, validates, logs or displays the recipient list, and then re-serializes it with fast-uri before sending can be tricked into delivering mail to an attacker-chosen address, with subject and body content smuggled across the same roundtrip. The flaw is rated 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-172 Encoding Error) and is fixed in fast-uri 4.1.5.
Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects releases before 2.4.7, 3.0.0 through 3.1.7, and 4.0.0 through 4.1.4. Because the library lowercases the host before percent-decoding it, an encoded uppercase octet such as %41 survives as a literal 'A', and in scheme-relative references like //host the canonicalization pass that would normally repair this never runs, so parse, normalize, and equal disagree about the same hostname. Any application that makes a case-sensitive host decision on fast-uri output — a host allowlist or denylist comparing the parsed host, or code relying on equal — can be steered past that check while the evading spelling still resolves to the gated host in DNS and HTTP. Exploitation status: no public exploit identified at time of analysis.
Google Chrome for Android versions prior to 153.0.8010.47 contain an out-of-bounds read in the WebGL rendering path that allows a remote attacker to leak memory from outside the browser sandbox by luring a victim into opening a crafted HTML page. Google labels the Chromium security severity as Critical, while the published CVSS 3.1 base score is a comparatively modest 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) because the flaw yields a limited confidentiality leak rather than code execution or data modification. A vendor patch is available, and no public exploit code or CISA KEV entry was identified at the time of analysis.
An uninitialized-resource flaw (CWE-908) in ANGLE, the graphics translation layer used by Chrome to render WebGL and accelerated 2D content, is present in Google Chrome builds prior to 153.0.8010.47. A remote attacker who convinces a user to open a crafted HTML page can cause ANGLE to return memory contents that were never initialized, disclosing data that is outside Chrome's sandbox boundary — an information-disclosure primitive rather than a code-execution bug. Google rates the issue High severity (Chromium) and has published a fixed build; the NVD CVSS score is 4.7 and there is no CISA KEV entry or identified public exploit code at time of analysis.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets an attacker who already holds a high-privileged logon on the host read a limited subset of VirtualBox-accessible data and trigger a partial denial of service against the hypervisor. The scope-change rating (S:C) indicates the impact can extend beyond VirtualBox itself to other products on or around the host, but exploitation requires local logon with elevated privileges and there is no indication of remote reach. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so real-world priority is driven by host-access hygiene rather than internet-facing exposure.
Let me analyze this CVE. CVE-2026-79705: buildah/copier Go package. Path traversal via malicious symlinks in crafted tar archive, escaping extraction directory, writing files outside destination. When used outside Buildah by a non-root caller. Buildah itself uses chroot hardening, not affected. CVSS 3.1: 4.5, AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N CWE-22 Path Traversal. CPE: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10 (odd that RHEL 10 listed; also RHEL 8/9/10 tags). Tags: Path Traversal, RHEL 10, RHEL 8, RHEL 9, OpenShift Container Platform 4, Ansible Automation Platform 2, Quay 3, Red Hat Hardened Images, OpenShift Virtualization 4, OpenShift Dev Spaces, Red Hat. SSVC: Exploitation none, Automatable no, Technical Impact partial. No EPSS given, no KEV. No POC mentioned. Patch data missing. Product name: buildah/copier Go package — but "1-3 words ONLY". "Buildah copier" or "containers/copier"? The primary product affected in CPE is Ansible Automation Platform 2. Hmm. The vulnerable component is the buildah/copier Go package. Product name should be... "Buildah copier" maybe. Let me use "Buildah copier". Actually the go package is github.com/containers/buildah/copier. Let's say "Buildah copier" as product name. Or "copier (Buildah)". Keep 1-3 words: "Buildah copier". Prevalence: Buildah itself is widely used but this affects copier library when used outside Buildah. Red Hat Ansible Automation Platform 2 is enterprise software. Prevalence: medium? Buildah library used broadly... The affected deployments: Red Hat products. Hmm. I'd say "medium". Assessed CVSS: The described exploitation: non-root caller, crafted tar archive, malicious symlinks. Attack vector network (AV:N given, PR:H, UI:R). The score of 4.5 matches AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N = let's verify: AV:N 0.85, AC:L 0.77, PR:H 0.27, UI:R 0.62. Exploitability = 8.22 * 0.85 * 0.77 * 0.27 * 0.62 = 8.22*0.85=6.987; *0.77=5.38; *0.27=1.4526; *0.62=0.9006. Impact: ISC affected C:
Rendering a crafted Lottie vector animation with Samsung's open-source rLottie library can overflow a fixed-size stack buffer during run-length-encoding of render spans, corrupting memory in the host application. The flaw affects rLottie builds at revision 480a2ad0c5d2e45458c545b8213279e9e8b71e39 and is rated only 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) because an attacker must induce the victim application to render a malicious animation; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. An upstream fix exists in Samsung/rlottie pull request 607, which increases the span array capacity and adds explicit bounds checks.
Denial of service in Oracle VM VirtualBox 7.2.16, where a local attacker who already holds a low-privileged logon session on the host can trigger a fault in the Core component that hangs or repeatedly crashes the VirtualBox process. Exploitation is difficult (AC:H) and requires active interaction from a different user on the same machine, and the impact is limited to availability — no confidentiality or integrity loss — giving a CVSS 3.1 base score of 4.4. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so treat it as a local reliability/DoS nuisance rather than a remote compromise risk.
Uninitialized memory use in multiple locations of the Android kernel allows a locally-positioned attacker who already holds System-level execution privileges to read stale kernel memory contents, resulting in information disclosure. The flaw is rated CVSS 4.4 (AV:L/PR:H) and affects Android builds covered by the September 2026 Pixel/Android Security Bulletin; user interaction is not required. No public exploit code and no CISA KEV listing were identified at time of analysis, and the exploitation prerequisite of pre-existing System privileges keeps the practical risk confined to post-compromise or privileged-local scenarios.
A logic error in the Android kernel's ACFW FF-A (Firmware Framework for Arm A-profile) driver, implemented in acfw_ffa.c, allows a caller already holding System-level execution privileges to read memory that should remain secret, resulting in local information disclosure. Exploitation requires local access and high privileges, needs no user interaction, and affects Android devices carrying the affected kernel build per Google's Pixel security bulletin for September 2026. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 base score of 4.4 reflects limited confidentiality impact confined to already-privileged local actors.
Improper input validation in the MBU class handler (validate_ns_buf in mbu_class.rs) of the Android kernel allows a component already running with System execution privileges to supply a malformed namespace buffer and read kernel memory beyond the intended bounds, disclosing sensitive data. Affected are Android devices built on the impacted kernel (CPE cpe:2.3:a:google:android) as addressed by the September 2026 Android/Pixel security bulletin. The CVSS 3.1 score of 4.4 is intentionally modest because exploitation demands local code execution at a high privilege level (PR:H) with no user interaction; no public exploit code has been identified and no EPSS score was supplied with this record.
A logic error in the Android kernel's VPU (Video Processing Unit) driver can disclose kernel memory contents to code that is already running with System-level privileges. The flaw is local-only: CVSS gives AV:L with PR:H, so an attacker must first obtain elevated (System) execution on the device before triggering the information leak, and no user interaction is required once that precondition is met. There is no public exploit code and no CISA KEV listing at time of analysis, and the associated EPSS data was not supplied, so this should be treated as a post-compromise information-disclosure primitive rather than a remotely exploitable issue.
Local information disclosure in Google Android's CPM component allows a caller holding System-level execution privileges to read protected data by abusing a confused deputy (CWE-441) that performs an action on behalf of a less privileged requester without re-validating the caller's authority. Only locally positioned code already running with System privileges on an affected Android build can trigger the flaw, and no user interaction is required. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical risk is limited to post-compromise or privileged-app scenarios rather than remote attack.
An out-of-bounds read in the AES-GCM-256 crypto implementation of the Android kernel (function do_sss_aes_gcm_256_op in crypto-aes.c) allows disclosure of memory contents to code that is already running at System privilege on an affected device. The flaw is a missing bounds check on an input length or index (CWE-120 class buffer handling error), rated 4.4 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation is local and requires the attacker to already hold System (PR:H) execution privileges; no user interaction is needed once that position is held. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the entry point sits behind a high privilege boundary the practical risk is a post-compromise or chained privilege-escalation information leak rather than an independent remote threat.
A path-handling flaw in the containers/storage Go library lets a crafted tar archive containing a malicious whiteout entry (for example 'victim/.wh.') cause UnpackLayer, ApplyLayer, or ApplyUncompressedLayer to replace the extraction destination directory with an arbitrary file. Systems that unpack container image layers with this library — notably Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, OpenShift Container Platform 4, Quay 3, OpenShift Virtualization, Dev Spaces, and Red Hat Hardened Images — are in scope. Exploitation requires the operator or process to unpack an attacker-supplied archive, and the integrity impact is confined to the local extraction target; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the modest CVSS 3.1 base score of 4.4.
An integer overflow in Google Chrome's Compositing component (fixed in 153.0.8010.47) lets a remote attacker leak cross-origin data by getting a victim to open a crafted HTML page. Exploitation requires user interaction (the victim must load the page) but no authentication or elevated privileges, and the impact is limited to confidentiality - integrity and availability are unaffected per the CVSS vector. There is no public exploit code or CISA KEV listing at time of analysis, and the CVSS base score is only 4.3, so this is a browser-patching hygiene issue rather than an emergency incident response trigger.
Uninitialized memory handling in the Skia graphics library shipped with Google Chrome before 153.0.8010.47 lets a remote attacker leak cross-origin data when a victim opens a crafted HTML page. Exploitation is unauthenticated but requires the user to visit attacker-controlled content (UI:R), and impact is limited to partial confidentiality loss with no integrity or availability effect (CVSS 4.3). Google has released a stable-channel fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
A partial denial-of-service flaw in the Core component of Oracle Coherence lets a low-privileged, network-positioned attacker degrade availability of the distributed data grid by sending crafted HTTP requests. Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product are listed as affected by Oracle and mirrored by EUVD (EUVD-2026-79717). The CVSS 3.1 base score is only 4.3 because impact is limited to availability (A:L) with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was present in the supplied intelligence.
Unauthenticated memory disclosure in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker on an adjacent network segment read portions of system memory, exposing internal service details and workflow information. All shipping 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches are affected per the vendor-published version ranges. The CVSS score is only 4.3 (confidentiality-only, adjacent vector) and there is no public exploit code or CISA KEV listing, so this is best treated as a reconnaissance enabler rather than a standalone compromise — its value to an adversary is in chaining it with a separate privilege-escalation or authentication flaw.
Ingestion denial of service in Bugsink affects self-hosted instances running versions 2.2.1 and earlier, where any caller holding a valid project DSN can submit an event carrying an unusually large custom tag set and force the server to write excessive tag rows. Because Bugsink digests events through a single-writer database transaction, that oversized write blocks concurrent ingestion and temporarily starves the event pipeline of other projects and clients. Version 2.2.2 fixes this by enforcing a configurable MAX_EVENT_TAGS cap (default 100) before storage; the impact is strictly availability-limited, with no data exposure, event modification, or code execution, and no public exploit code or CISA KEV listing was identified at time of analysis.
The Bitnami Sealed Secrets controller (versions up to and including 0.38.4) turns its unauthenticated POST /v1/verify and /v1/rotate endpoints into a decryption oracle, letting an attacker with internal cluster network access — or a simple kubectl port-forward to port 8080 — recover the full plaintext of any sealed secret one character at a time. The flaw chains two weaknesses: spec.template.data is excluded from the AEAD authenticated-data label binding, so an attacker can replay a victim's metadata and encryptedData verbatim and substitute arbitrary Go template logic, and template execution errors are reflected directly in HTTP status codes (200 = success, 409 = failure), producing a reliable equality oracle. No public exploit code and no CISA KEV entry were associated with this CVE at the time of analysis, though the vendor has published a GitHub security advisory.
UI spoofing in Google Chrome's Transactions Platform component lets a remote attacker who has already compromised the browser's renderer process render crafted HTML as trusted interface elements, deceiving the user. The flaw is a missing authorization check (CWE-862) affecting Chrome versions prior to 153.0.8010.47, and it is not reachable on its own: exploitation requires a separate, earlier renderer compromise plus the victim loading and interacting with the attacker's page (UI:R, AC:H). Impact is limited to low-severity confidentiality and availability effects rather than code execution or sandbox escape, no public exploit code was identified at time of analysis, and the issue is fully resolved by Chrome 153.0.8010.47.
UI spoofing in Google Chrome versions prior to 153.0.8010.47 allows an attacker who has already compromised the browser's renderer process to draw convincing but fake interface elements in front of the user via a crafted HTML page. The flaw is a missing authorization check (CWE-862) on a browser-side privileged capability, rated Medium by the Chromium team and scored 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L), with impact limited to Low confidentiality and Low availability and no integrity effect. Exploitation is not possible as a standalone initial-access vector - renderer compromise is a mandatory precondition, user interaction is required, and attack complexity is High; no CISA KEV listing and no public exploit code were identified at time of analysis. A vendor-released patch exists in Chrome 153.0.8010.47.
Oracle VM VirtualBox 7.2.16 can be hung or repeatedly crashed by a high-privileged attacker who already has an interactive logon on the host where the hypervisor runs, provided another person on the system performs an interaction such as opening or starting a crafted VM. The flaw sits in VirtualBox Core and yields availability-only impact: any hosted guest and the VirtualBox process itself can be taken down. It is scored 4.2 and the local-plus-privileged access requirement makes mass exploitation unlikely; no public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis.
Server-side request forgery in the Fabric.js `loadFromJSON` method lets an attacker who can supply canvas JSON to a server-side Fabric.js implementation coerce the host into fetching arbitrary URIs, including internal network resources. The flaw is a missing URI validation step (CWE-918) that is triggered only when the library is used to render or parse untrusted JSON in a server context; browser-only usage of the canvas library is not exposed. ZDI rates it CVSS 4.0 (AV:L/AC:H), no public exploit code has been identified at time of analysis, and the library is not listed in CISA KEV; EPSS data was not available in the supplied intelligence.
Let me synthesize. CVE-2026-86465: Apache Airflow Akeyless provider secrets backend team-scope guard bypass via user-controlled key. Affected: apache-airflow-providers-akeyless before 0.3.1. Fix: 0.3.1. PR: https://github.com/apache/airflow/pull/72646. Similar class to Azure Key Vault, Yandex Lockbox, Amazon secrets backends CVEs. Multi-team deployments using Akeyless secrets backend; single-team not affected. Reachable from ordinary DAG code via Execution API Variables route accepting path-shaped key. DAG author scoped to one team can read secrets belonging to another team — info disclosure (cross-tenant secret access). CVSS: N/A provided. My assessed vector: PR:L (requires DAG author privileges / authenticated user), AV:N, AC:L, UI:N, S:C? Scope change — impacts another team's secrets, but scope change in CVSS terms means authorization scope. Cross-team boundary crossing could be S:C. Impact C:H, I:N, A:N. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. That's ~8.3? Let's compute: S:C base... Actually with S:C, PR:L: exploitability = 8.22*AV(0.85)*AC(0.77)*PR(0.68)*UI(0.85) = 8.22*0.85=6.987; *0.77=5.380; *0.68=3.658; *0.85=3.110. Impact: ISCBase = 1 - (1-C)(1-I)(1-A) = 1 - (1-0.56)(1)(1) = 0.56. Scope changed: Impact = 7.52*(ISC-0.029) - 3.25*(ISC-0.02)^15 = 7.52*(0.531) - 3.25*(0.54)^15 ≈ 3.993 - ~0 = 3.993. Base = roundup(min(1.08*(3.110+3.993),10)) = roundup(7.67) = 7.7. Hmm, 7.7 High. Maybe S:C is arguable. Alternatively S:U with C:H gives: Impact = 6.42*0.56 = 3.595; exploitability 3.110; base = roundup(min(1.08*6.705,10)) = roundup(7.24)=7.3. Either way ~7.3-7.7. Actually, "moderate" severity per Apache. Hmm. Apache's own severity is "moderate". But my assessment... I'll go with S:C? Let's think: the vulnerable component is the Akeyless backend; the impact is a different team's secrets. CVSS scope change refers to impact on components beyond the vulnerable component's security authority. The secrets backend... Hmm. This is a classic cross-tenant autho
Password changes made through the Apache Airflow FAB provider's Admin user-edit PATCH endpoint do not invalidate that user's existing database-backed sessions, so anyone already holding a copy of the victim's session cookie keeps full access to the account after the reset. The flaw affects apache-airflow-providers-fab 3.2.0 up to (but not including) 3.9.0 in deployments using the FAB auth manager with database-backed sessions, and it is a second, independent route to the outcome addressed by CVE-2026-82311 — applying that earlier fix alone does not remediate this endpoint. The advisory rates the issue moderate; no public exploit code, CISA KEV listing, or EPSS score was provided with the intelligence supplied.
Stale database-backed sessions in the Apache Airflow FAB provider (apache-airflow-providers-fab 3.2.0 before 3.9.0) allow an attacker who already holds a copy of a victim's session cookie to keep full access to that account even after the account password is changed, because the Admin user-edit PATCH endpoint never calls the session-invalidation helper. This is a second, independent route to the outcome partially addressed by CVE-2026-82311, so deployments that only applied that earlier fix remain exposed and must additionally upgrade to 3.9.0 or later. No public exploit code or active exploitation is identified from the available data; severity is rated moderate by the vendor.
The Apache Airflow Keycloak provider (apache-airflow-providers-keycloak before 0.10.0), when running on Airflow 3.3 or later, performs authorization using Keycloak access and refresh tokens read from separate, unsigned cookies while taking the user's identity from the signed Airflow session token, and never verifies that both describe the same subject. Any user
Path-name disclosure in Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 lets a connected client learn the names of ACL-restricted znodes by registering exists-watches on paths that do not yet exist and then reconnecting after those paths are created under restrictive ACLs. The reconnect replay handler DataTree.setWatches() delivers the watch notification with a null ACL, bypassing the ACL check that was added to WatchManager.triggerWatch() as the fix for CVE-2024-23944 (ZOOKEEPER-4799), making this an incomplete-fix bypass. Only the znode path string is exposed, not znode data, but because paths frequently embed usernames, login IDs, or tenant identifiers, Apache and the reporter rate it critical; no public exploit code or confirmed active exploitation was identified at time of analysis.
CVE-2026-75883 is an Ubuntu security update with no technical details publicly disclosed at time of analysis. The description contains only the phrase 'security update,' providing no information about the vulnerability class, affected component, or attacker capabilities. No CVSS vector, CWE, or supplementary intelligence is available to characterize impact or exploitation conditions.
Insufficient data exists to characterize this vulnerability. The only available intelligence is a CVE identifier, a two-word description ('security update'), and a single vendor attribution to Ubuntu. No affected product, component, version range, vulnerability class, impact, or attack vector has been disclosed in the provided data. No independent assessment of severity, exploitability, or remediation is possible from the available information.
CVE-2026-86320 is a vulnerability reported via the Ubuntu vendor channel for which no public description, CVSS score, CWE classification, or technical detail has been disclosed at time of analysis. The affected product and impact cannot be independently characterized from available intelligence. Security teams should monitor the Ubuntu Security Notices (USN) portal and the Ubuntu CVE tracker for disclosure once an advisory is published.