Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.58 security and extras update

Red Hat OpenShift Container Platform release 4.17.58 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a security impact of...

Exploit for CVE-2026-88789

CVE-2026-88789 — Camel Quarkus: forced Xalan TransformerFacto...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for September 2026.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 26.0.0-IF003, 25.0.0-IF007 and 24.0.0-IF009. These vulnerabilities have been also addressed in 24.0.1-IF009 Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion through 5.0.7 is vulnerable to...

BIT-RABBITMQ-2026-66078 RabbitMQ: protected tag bypass via bulk-delete

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

CVE-2026-15983

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CVE-2026-15983 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

EUVD-2026-90563

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CVE-2026-15983 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CVE-2026-15983

The Super Forms – Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316 ) is vulnerable to Arbitrary File/Directory Deletion . The root cause stems from a lack of capability checks in the super_save_form AJAX handler, allowing Subscriber-level authenticated users...

CVE-2026-15983 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

EUVD-2025-209816

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference IDOR in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccbwoocommercepayment AJAX...

AlmaLinux 9.2 [TuxCare] Security Update: c-ares / c-ares-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1744721593)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1744721593 advisory. - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will...

AlmaLinux 9.2 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1747432102)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1747432102 advisory. - A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting...

AlmaLinux 9.6 [TuxCare] Security Update: apr-util / apr-util-bdb / apr-util-devel / apr-util-ldap / etc (ALMALINUX9.6:CLSA-2026:1786623875)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786623875 advisory. - APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons,...

Rocky Linux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781004077)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781004077 advisory. - During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo Multiple Vulnerabilities (crlsa-2022_7519)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227519 advisory. sanitize-url: XSS due to improper sanitization in sanitizeUrl function CVE-2021-23648 golang: net/http: improper sanitization of Transfer-Encoding header...

AlmaLinux 9.6 [TuxCare] Security Update: libblkid / libblkid-devel / libfdisk / libfdisk-devel / libmount / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782989143)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782989143 advisory. - wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users'...

AlmaLinux 9.2 [TuxCare] Security Update: redis / redis-devel / redis-doc (ALMALINUX9.2:CLSA-2025:1753801232)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753801232 advisory. - Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially...

AlmaLinux 9.2 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789551334)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789551334 advisory. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memor...

Rocky Linux 9.6 [TuxCare] Security Update: apr-util / apr-util-bdb / apr-util-devel / apr-util-ldap / etc (ALMALINUX9.6:CLSA-2026:1786623875)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786623875 advisory. - APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons,...