Red Hat Security AdvisoryRHSA-2026:54432
multicluster engine for Kubernetes v2.10.5 security update
Released 2026-08-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +1
Fixes 8 records
Priority MEDIUM 48
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00478 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-862
Priority MEDIUM 44
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02044 · Published 2026-08-11 · Fixed in 16.0.5565.1001, 16.0.10417.20198 +1 CWE-502
Priority MEDIUM 44
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02044 · Published 2026-08-11 · Fixed in 16.0.20326.20190 CWE-502
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00473 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-704
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-347
Priority LOW 30
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00591 · Published 2026-06-02 · Partial fix · 1.25.11, 1.26.4
Priority LOW 28
The HTTP client drops sensitive headers after following a cross-domain redirect.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0071 · Published 2025-01-28 · Partial fix · 1.22.11, 1.23.5 +1
Priority LOW 19
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture.
CVSS 3.1MEDIUM 4.0· Local · No auth · No interaction · EPSS 0.0029 · Published 2025-02-06 · Partial fix · 1.22.12, 1.23.6 +1
THREATIST.IORead the docs