coderedcms (>=0.11.0, <=0.14.1), coop (>=2.0.0, <=2.4.5) +4 more potentially affected by CVE-2026-28223 via wagtail (2.4.0)

wagtail PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.11.0, =2.0.0, =4.0.3, =0.6.0, =0.1.0.dev8, =0.7.0, =0.16.4 Source cves: CVE-2026-28223 Source advisory: OSV:GHSA-P4V8-RW59-93CQ...

coop (>=0.5.0, <=0.5.3), wagtail-flags (2.0.7) +3 more potentially affected by CVE-2026-28223 via wagtail (1.10.1)

wagtail PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =0.5.0, =0.9.0, =0.10.0, =0.10.2 - wagtail-sharing 0.6.0 Source cves: CVE-2026-28223 Source advisory: OSV:GHSA-P4V8-RW59-93CQ...

coderedcms (>=0.19.0rc1, <=0.19.1), coop (>=2.9.0, <=2.9.3) +14 more potentially affected by CVE-2026-28223 via wagtail (2.9.3)

wagtail PYPI version 2.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.19.0rc1, =2.9.0, =2.5.3, =0.1.0, =0.22.3, =0.1.0, =0.4.0 - wagtailmodelchooser 0.3.0 - wagtailperson 0.11.0 - wagtailpress 0.10.0 an...

coderedcms (>=0.11.0, <=0.14.1), coop (>=2.0.0, <=2.4.5) +4 more potentially affected by CVE-2026-28222 via wagtail (2.4.0)

wagtail PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.11.0, =2.0.0, =4.0.3, =0.6.0, =0.1.0.dev8, =0.7.0, =0.16.4 Source cves: CVE-2026-28222 Source advisory: OSV:GHSA-P5CM-246W-84JM...

coderedcms (>=0.19.0rc1, <=0.19.1), coop (>=2.9.0, <=2.9.3) +14 more potentially affected by CVE-2026-28222 via wagtail (2.9.3)

wagtail PYPI version 2.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.19.0rc1, =2.9.0, =2.5.3, =0.1.0, =0.22.3, =0.1.0, =0.4.0 - wagtailmodelchooser 0.3.0 - wagtailperson 0.11.0 - wagtailpress 0.10.0 an...

coderedcms (>=0.5.0, <=0.7.1), coop (>=2.1.0b0, <=2.1.4) +3 more potentially affected by CVE-2026-28222 via wagtail (2.1.3)

wagtail PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.5.0, =2.1.0b0, =0.5.0, =0.0.2, =0.0.5 Source cves: CVE-2026-28222 Source advisory: OSV:GHSA-P5CM-246W-84JM...

coop (>=0.5.0, <=0.5.3), wagtail-flags (2.0.7) +3 more potentially affected by CVE-2026-28222 via wagtail (1.10.1)

wagtail PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =0.5.0, =0.9.0, =0.10.0, =0.10.2 - wagtail-sharing 0.6.0 Source cves: CVE-2026-28222 Source advisory: OSV:GHSA-P5CM-246W-84JM...

coderedcms (>=0.18.0, <=0.18.2), coop (>=2.8.0, <=2.8.2) +10 more potentially affected by CVE-2026-28222 via wagtail (2.8.2)

wagtail PYPI version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.18.0, =2.8.0, =0.0.5, =4.1.0, =0.5.0, =1.0.0, =0.22.0, =3.8.0, =3.9.0 Source cves: CVE-2026-28222 Source advisory:...

CLSA-2026-1772124479 golang: Fix of 7 CVEs

Update to Go 1.25.7 - CVE-2025-61726: fixed DoS due to memory exhaustion flaw in net/url parameter parsing - CVE-2025-61732: fixed RCE via code smuggling flaw in cgo comment parsing - CVE-2025-68121: fixed security bypass in TLS where session resumption could ignore revoked or expired client...

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

Impact The serialize-javascript npm package versions tags, the injected code executes. javascript const serialize = require'serialize-javascript'; // Create an object that passes instanceof RegExp with a spoofed .flags const fakeRegex = Object.createRegExp.prototype; Object.definePropertyfakeRege...

GHSA-5C6J-R48X-RMVQ Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

Impact The serialize-javascript npm package versions tags, the injected code executes. javascript const serialize = require'serialize-javascript'; // Create an object that passes instanceof RegExp with a spoofed .flags const fakeRegex = Object.createRegExp.prototype; Object.definePropertyfakeRege...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:0617-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0617-1 advisory. The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues The following security issues were fixed: -...

CVE-2026-28400 Docker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpoint

Docker Model Runner DMR is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST /engines/configure endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server llama.cpp...

CVE-2026-28400 Docker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpoint

Docker Model Runner DMR is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST /engines/configure endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server llama.cpp...

CVE-2026-28400

Docker Model Runner DMR is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST /engines/configure endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server llama.cpp...

GHSA-4685-C5CP-VP95 OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags

Summary tools.exec.safeBins could be bypassed for filesystem access when sort output flags -o / --output or recursive grep flags were allowed through safe-bin execution paths. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.2.19 - Latest published version at triag...

UBUNTU-CVE-2026-23230

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cachedfid bitfields to avoid shared-byte RMW races isopen, haslease and onlist are stored in the same bitfield byte in struct cachedfid but are updated in different code paths that may run concurrently. Bitfiel...

Linux Distros Unpatched Vulnerability : CVE-2026-23230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: split cachedfid bitfields to avoid shared-byte RMW races isopen, haslease and onlist are stored in the same bitfield byte in struct cachedfid but a...

SUSE CVE-2026-23200

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix ECMP sibling count mismatch when clearing RTFADDRCONF syzbot reported a kernel BUG in fib6addrt2node when adding an IPv6 route. 0 Commit f72514b3c569 "ipv6: clear RA flags when adding a static route" introduced logic to...

CVE-2026-23181

In the Linux kernel, the following vulnerability has been resolved: btrfs: sync read disk super and set block size When the user performs a btrfs mount, the block device is not set correctly. The user sets the block size of the block device to 0x4000 by executing the BLKBSZSET command. Since the...