Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...

kernel: net: bridge: stop fast-leave after deleting a port group

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...

RHEL 8 : kernel (RHSA-2026:62372)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62372 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: bridge: stop fast-leave after...

RHEL 9 : kernel (RHSA-2026:62508)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62508 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv4: free...

RHEL 8 : kernel (RHSA-2026:62345)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62345 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: bridge: stop fast-leave after...

RHEL 9 : kernel-rt (RHSA-2026:62522)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62522 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

CVE-2026-84470 Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-84470

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-12663

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...

EUVD-2026-69136

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

RHEL 8 : kernel (RHSA-2026:61973)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61973 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: bridge: stop fast-leave after...

PT-2026-84212

Name of the Vulnerable Software and Affected Versions ControlFLASH versions 15.07 and earlier Description The installer grants write permissions to the Everyone group on the product installation directory. This flaw allows for arbitrary code execution, enabling an attacker to run any commands or...

CVE-2026-79746

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' or 'custom' is used against a group route,...

CVE-2026-79746

MCPHub (by samanhappy) is a unified hub for managing and orchestrating multiple MCP servers into separate endpoints with flexible routing. Prior to version 1.0.31 , the isBearerKeyAllowedForRequest function contained an authorization flaw: when a bearer key with accessType: 'servers' or 'custom' ...

CVE-2026-79746 MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' or 'custom' is used against a group route,...

CVE-2026-79746 MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' or 'custom' is used against a group route,...

BIT-KEYCLOAK-2026-18571 Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More

The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional...

CVE-2026-82633

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...