Upwind Security MDR

🚨 CRITICAL - Unauthenticated SQL Injection in Craft CMS (CVE-2026-123488) A critical SQL injection flaw in the Craft CMS element search endpoint allows unauthenticated remote attackers to manipulate queries via unsanitized attribute parameters. Due to emulated PDO prepared statements allowing stacked queries, attackers can read/write the database, overwrite password hashes, or grant themselves administrative access. 👉 Affected: Craft CMS 4.0.0 < 4.18.9 and 5.0.0 < 5.11.2 | Upgrade immediately to v4.18.9 or v5.11.2

🚨Critical - Chartbrew Forged Session JWT Auth Bypass (CVE-2026-85295) Chartbrew’s API/socket auth helpers accept forged HS256 session JWTs when CB_SECRET is default/weak/known due to a legacy verification fallback. In stock Docker Compose deployments, attackers can mint a token for a victim userId and impersonate them without password/2FA, inheriting full privileges. 👉Affected: chartbrew < 5.2.3 | Upgrade to 5.2.3

🚨Critical - IBM DataStage Absolute Path Traversal Info Disclosure (CVE-2026-107331) IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to abuse absolute path traversal in DataStage file handling to read arbitrary files outside the intended directory. Successful exploitation can expose sensitive information. Unauthenticated attackers are not impacted. 👉Affected: IBM DataStage on Cloud Pak for Data 5.4.0.0 | Upgrade to 5.4 patch 8 or later

🚨High - Kyverno Generate Rule Templating AuthZ Bypass (CVE-2026-124441) Kyverno background-controller allows variable templating of a generate rule’s kind and namespace, letting a namespaced tenant craft a Policy + trigger ConfigMap in their namespace to make the privileged controller write arbitrary resource kinds (e.g., RoleBindings/NetworkPolicies) into victim or kube-system namespaces. Non-generate rules aren’t affected. 👉Affected: kyverno < 1.19.2 | Upgrade to 1.19.2

🚨Critical - Kyverno apiCall Namespace Clamp AuthZ Bypass (CVE-2026-124440) Kyverno's apiCall namespace clamp can be bypassed by appending malformed percent-escapes to urlPath, causing cross-namespace/cluster-scoped API requests to run as the admission-controller ServiceAccount. This enables reading other namespaces and creating mutating webhooks for potential cluster-admin escalation. 👉Affected: github.com/kyverno/kyverno >= 1.19.1, < 1.19.2 | Upgrade to 1.19.2

🚨High - SSSD HBAC Trust Username Collision Access Bypass (CVE-2026-104048) In SSSD trust-enabled setups, HBAC evaluation strips domain qualifiers and compares only short usernames. An authenticated user from a trusted domain sharing a username with an allowed local account can bypass HBAC and access protected services/hosts. Non-trust deployments aren’t impacted. 👉Affected: sssd (trust-enabled HBAC) | openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9

🚨High - Keycloak Dynamic Client Registration Claim Injection/Impersonation (CVE-2026-92857) Keycloak Dynamic Client Registration request validation allows a malicious client to set protocol mappers that copy attacker-controlled profile fields into protected claims. With valid registration/admin tokens, an attacker can mint signed tokens with forged sub/aud to impersonate users and access relying services. 👉Affected: keycloak/rhbk-openshift-rhel9, keycloak-services, rhbk/keycloak-rhel9

🚨 CRITICAL - Memory-Safety Vulnerabilities in AWS Babelfish for Aurora PostgreSQL AWS has disclosed two memory-safety vulnerabilities in the Tabular Data Stream (TDS) protocol layer of Babelfish for Aurora PostgreSQL: • CVE-2026-119923: Flaw in TDS connection-handshake handling allowing unauthenticated remote attackers to compromise database confidentiality, integrity, and availability. • CVE-2026-119924: RPC request-handling flaw allowing authenticated attackers to read adjacent process memory or cause Denial of Service. 👉 Affected / Remediation: Upgrade Aurora PostgreSQL clusters to the latest patched minor versions (e.g., 18.4.1 / 17.10.1 / 16.14.1 / 15.18.1 / 14.23.1 / 13.23.3) or open-source extensions 4.10, 5.6, 6.1+. Immediate mitigation: Restrict port 1433 via VPC security groups.

🚨Critical - AWS REX SSM Document Provisioning Script OS Command Injection (CVE-2026-122193) The example provisioning script for AWS Trusted Remote Execution (REX) creates Rex-RO/Rex-RW SSM documents with unsafe parameter handling, enabling OS command injection. Any authenticated principal allowed to invoke Rex-RO or Rex-RW can run arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement. Not impacted if you never deployed these example-created SSM documents. 👉Affected: rex-runner (REX example SSM doc provisioning script before 2026-07-28)

🚨Critical - OpenAM Session Token Leak via Liberty ID-FF Forward to Notifications WebSocket (CVE-2026-123551) OpenAM’s notifications WebSocket leaks live iPlanetDirectoryPro session tokens to unauthenticated clients when an agent-only check is bypassed via an unvalidated internal forward from legacy Liberty ID-FF endpoints. Attackers can harvest tokens and hijack user/admin sessions. Non-Liberty ID-FF deployments aren’t impacted. 👉Affected: OpenAM 14.0.0 < 16.1.4 | Upgrade to 16.1.4

🚨High - Google::Auth OAuth Loopback State Validation Bypass (CVE-2026-74760) Google::Auth (Perl) gcloud-auth loopback login callback fails to validate the OAuth state and accepts the first authorization code received. A local attacker can race the loopback listener and inject their own auth code, causing the CLI to store the attacker’s refresh token and run subsequent actions under the attacker’s Google account. 👉Affected: Google-Auth 0.11-0.12

🚨High - aiohttp DoS via multipart/form-data Infinite Loop (CVE-2024-30251) aiohttp's multipart/form-data POST parser can be driven into an infinite loop by a specially crafted malformed multipart request, consuming the event loop and preventing the server from handling further requests after a single hit. Non-multipart handlers aren’t affected. 👉Affected: aiohttp < 3.9.4 | Upgrade to 3.9.4

🚨Critical - Kyverno Cross-Namespace PrivEsc via CEL targetMatchConstraints (CVE-2026-122313) Kyverno NamespacedMutatingPolicy targetMatchConstraints.expression (CEL) output lacks namespace enforcement. A namespace-scoped tenant can return a literal cross-namespace target; the cluster-wide background controller applies mutations to that object, enabling edits to RoleBindings/Roles/NetworkPolicies/ConfigMaps outside the tenant namespace. 👉Affected: github.com/kyverno/kyverno >= 1.17.0, < 1.19.2 | Upgrade to 1.19.2

🚨Critical - Kyverno Admission Controller Namespace Escape via resource.get()/post() Path Traversal (CVE-2026-122311) Kyverno fails to validate path segments in the resource argument to resource.get() and resource.post(). A tenant who can create a NamespacedValidatingPolicy can inject '..' to traverse out of the namespace and read/write arbitrary cluster objects using the admission controller ServiceAccount, leading to potential cluster takeover. 👉Affected: github.com/kyverno/kyverno >= 1.16.0 < 1.19.2 | Upgrade to 1.19.2

🚨High - Microsoft Paint OOB Read Remote Code Execution (CVE-2026-83844) Windows Microsoft Paint mishandles crafted image parsing, triggering an out-of-bounds read that can be leveraged for remote code execution when a victim opens a malicious file delivered over the network (e.g., SMB/WebDAV/download). No auth required; user interaction is required. 👉Affected: Microsoft Paint 11.0.0.0 to < 11.2605.91.0 | Upgrade to 11.2605.91.0

🚨Critical - Docker Desktop WSL2 seccomp AF_VSOCK bypass via 32-bit socketcall (CVE-2026-112917) In Docker Desktop for Windows using the WSL2 backend, an unprivileged Linux container can invoke 32-bit socketcall to bypass the default seccomp block on AF_VSOCK, reaching host-facing vsock services. This can expose Windows files accessible to the logged-in user on affected x86-64 WSL2 systems; LinuxKit-based backends are not impacted. 👉Affected: Docker Desktop for Windows (WSL2 backend) < 4.98.0 and/or WSL < 3.0.3 | Upgrade to Docker Desktop 4.98.0 + WSL 3.0.3