CVE-2025-15661 affecting package libssh2 for versions less than 1.11.1-4

CVE-2025-15661 affecting package libssh2 for versions less than 1.11.1-4. A patched version of the package is available...

CVE-2026-10698

CVE-2026-10698 is an Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer, specifically affecting the Custom Reports module . Affected versions are MOVEit Transfer 2025.0.0–before 2025.0.8, 2025.1.0–before 2025.1.4, and 2026.0.0–before 2026.0.1...

PT-2026-56857

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.10 OpenEXR versions prior to 3.3.12 OpenEXR versions prior to 3.4.13 Description A heap out-of-bounds write exists in the Imf 4 0::SampleCountChannel::setint r, unsigned int newNumSamples function. The row-based...

GHSA-86J7-9J95-VPQJ Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the oidc-provider plugin or the mcp plugin from better-auth/plugins. The mcp plugin wraps the same provider and carries the same defect. Both are on the migration path to...

GHSA-P2FR-6HMX-4528 @better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

Am I affected? Users are affected if all of the following hold: - Their application depends on @better-auth/oauth-provider on any stable 1.6.x release the stable line is not patched or on a pre-release before 1.7.0-beta.4. - Their application either configures validAudiences with more than one...

pgAdmin 4 has command injection vulnerability on Windows systems

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input...

PYSEC-2026-1771 pgAdmin 4 vulnerable to directory traversal

pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database...

PYSEC-2026-894 pgAdmin 4 Open Redirect vulnerability

Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL...

PT-2026-67312

Name of the Vulnerable Software and Affected Versions @better-auth/oauth-provider versions prior to 1.7.0-beta.4 Description @better-auth/oauth-provider fails to bind the access-token audience to the authorization grant, which allows clients to request tokens for unrelated resources. This occurs...

DEBIAN-CVE-2026-41515

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.9.0 and prior to version 4.11.0, the RSA-OAEP decryption implementation in the NXP CAAM crypto driver uses...

[SECURITY] Fedora 44 Update: python-rpds-py-0.29.0-4.fc44

Python bindings to the Rust rpds crate...

EUVD-2026-41864

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue...

Important Photon OS Security Update - PHSA-2026-4.0-1050

Updates of 'docker' packages of Photon OS have been released...

The vulnerability of the Maintenance Tool component of the pgAdmin 4 database management tool allows a hacker to execute arbitrary code.

The vulnerability of the Maintenance Tool component in the pgAdmin 4 database management tool is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the pgAdmin 4 database management tool, which exists due to the lack of measures to neutralize special elements, allows a hacker to execute arbitrary commands.

The vulnerability of the pgAdmin 4 database management tool exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the check_access_permission() function in the pgAdmin 4 database management tool allows a attacker to compromise the integrity and accessibility of protected information.

The vulnerability of the checkaccesspermission function in the pgAdmin 4 database management tool is related to deficiencies in the mechanism for handling symbolic links. Exploiting this vulnerability could allow a malicious actor to compromise the integrity and accessibility of the protected...

The vulnerability of the password blocking mechanism (MAX_LOGIN_ATTEMPS) in the pgAdmin 4 database management tool allows a malicious user to gain unauthorized access to protected information. [source-iocs-preserved const=MAX_LOGIN_ATTEMPTS]

The vulnerability of the password blocking mechanism MAXLOGINATTEMPS of the pgAdmin 4 database management tool is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to...

CVE-2026-54886: Loop with Unreachable Exit Condition

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Erlang OTP ssh sshsftpd module allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handledata/4 function in sshsftpd contains a catch-all clause that accepts channel data of any type. When...

CVE-2026-53422: Observable Response Discrepancy

Observable Response Discrepancy vulnerability in Erlang OTP ssh sshsftpd module allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSHFXPREALPATH handler in sshsftpd calls relatefilename/3 with Canonicalize=false, unlik...

freerdp security update

2.1.1-5.0.9 - Fixed CVE-2026-25952 CVE-2026-26986 CVE-2026-27951 CVE-2026-29775 CVE-2026-31883 CVE-2026-31884 CVE-2026-31885 CVE-2026-33985 Orabug: 39440279 2.1.1-5.0.7 - Fixed CVE-2026-22852 CVE-2026-22854 CVE-2026-22856 CVE-2026-23732 CVE-2026-23948 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676...