Weekly briefing

SecurityOpenshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

SecurityOpenshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint

SecurityOpenshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

SecurityPart-DB: Authenticated RCE via .phar attachment upload served from public/media

SecurityPath traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer

SecurityPraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation

SecurityRelative path traversal during model archive extraction in Amazon Web Services Multi Model Server

SecurityRemote Code Execution in CGM CLININET2 source records

Newly collected advisory · 2 entries

• Remote Code Execution in CGM CLININET

  Newly collected advisory

  CVE-2025-30046

  Assessment context

  Newly collected advisory; observed by ChangeIntel, not the original publication date.

• Remote Code Execution in CGM CLININET

  Newly collected advisory

  CVE-2025-30050

  Assessment context

  Newly collected advisory; observed by ChangeIntel, not the original publication date.

SecurityRemote Code Execution via Java Deserialization in CGM CLININET

SecuritySeetong T8108/T8108P/T8116/T8232 Debug Service improper authentication

SecurityTDDPv2 setProductVer Command Injection in Archer AX90

SecurityThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.5 source records

Source marks advisory rejected · 5 entries

• This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Source marks advisory rejected

  CVE-2026-108537

  Assessment context

  Source marks advisory rejected; observed by ChangeIntel, not the original publication date.

• This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Source marks advisory rejected

  CVE-2026-108793

  Assessment context

  Source marks advisory rejected; observed by ChangeIntel, not the original publication date.

• This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Source marks advisory rejected

  CVE-2026-110814

  Assessment context

  Source marks advisory rejected; observed by ChangeIntel, not the original publication date.

SecurityTinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php

SecurityUnauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access

SecurityUnauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution2 source records

Affected-version evidence changed · 2 entries

• Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution

  Affected-version evidence changed

  CVE-2026-79862

  Assessment context

  Affected-version evidence changed; observed by ChangeIntel, not the original publication date.

• Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution

  Affected-version evidence changed

  CVE-2026-79863

  Assessment context

  Affected-version evidence changed; observed by ChangeIntel, not the original publication date.

SecurityUnauthenticated Adjacent Buffer Overflow Vulnerability in the PAPI Protocol leads to Sensitive Information Disclosure in AOS-10

SecurityUnauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8

SecurityUnauthenticated Adjacent Command Injection Vulnerability in AOS-10

SecurityUnauthenticated Adjacent Command Injection Vulnerability in the AOS-8 Command Line Interface Accessed by the PAPI Protocol

SecurityUnauthenticated Adjacent Command Injection Vulnerability in the PAPI Protocol of AOS-10

SecurityUnauthenticated Adjacent Memory Corruption Vulnerabilities lead to Remote Code Execution in AOS-10

SecurityUnauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10

SecurityUnauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8

SecurityUnauthenticated Adjacent Remote Code Execution Vulnerability in AOS-10