CVE-2026-45566 Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the login flow allow-lists next URLs by rejecting strings containing https:// or http:// substrings, then constructs https://request.hostnexturl and the JS client redirects via...

info.bluefloyd.jenkins:jenkins-jira-issue-updater (>=1.17, <=1.18), jenkins.plugins:mqtt-notification-plugin (1.3) +6 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (1.600)

org.jenkins-ci.main:jenkins-core MAVEN version 1.600 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - info.bluefloyd.jenkins:jenkins-jira-issue-updater =1.17, =1.14, =1.20, =1.21 -...

info.bluefloyd.jenkins:jenkins-jira-issue-updater (>=1.17, <=1.18), jenkins.plugins:mqtt-notification-plugin (1.3) +6 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (1.600)

org.jenkins-ci.main:jenkins-core MAVEN version 1.600 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - info.bluefloyd.jenkins:jenkins-jira-issue-updater =1.17, =1.14, =1.20, =1.21 -...

info.bluefloyd.jenkins:jenkins-jira-issue-updater (>=1.1, <=1.13), jenkins.ci.plugins.computerqueue:computer-queue-plugin (>=1.0, <=1.3) +6 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (1.437)

org.jenkins-ci.main:jenkins-core MAVEN version 1.437 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - info.bluefloyd.jenkins:jenkins-jira-issue-updater =1.1, =1.0, =1.3 -...

CVE-2026-53438

A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view...

Security update for kubernetes1.27

This update for kubernetes1.27 fixes the following issues CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265740. CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service...

CVE-2026-53437

Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier ) are vulnerable to an open redirect issue due to improper input validation. The application fails to correctly verify redirect URLs after login when they contain tab or newline characters between //. Attackers can exploit this behavior ...

BELL-CVE-2026-42770

Bulletin has no description...

BELL-CVE-2026-42768

Bulletin has no description...

CVE-2026-52750 Ghidra < 12.1- Command Injection via URL Annotation Click

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click...

MINI-2CF9-7CM4-PW78

Bulletin has no description...

MINI-MXP7-HW7J-RG33

Bulletin has no description...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...

CVE-2026-44291

creationtimestamp| type| source ---|---|--- 2026-06-10 09:00:04+00:00| published-proof-of-concept| Telegram/ZHpMnVOz2cJfIOonPjLT3mqz43XsQAtrT-ty2tkYMtXDqE...

BIT-APACHE-2026-44631 Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...

MGASA-2026-0188 Updated jq packages fix security vulnerabilities

An integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. CVE-2024-23337 It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue to cause a denial of...

Updated jq packages fix security vulnerabilities

An integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. CVE-2024-23337 It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue to cause a denial of...

CVE-2026-36720

Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type...

SUSE CVE-2026-46327

In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dmsuspendedmd The function dmblkreportzones tests if the device is suspended with the "dmsuspendedmd" call. However, this function is called without holding any locks, so the device may be suspended just...

SUSE CVE-2026-52906

In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being ORed instead of replaced Since commit 1f3e4142c0eb "9p: convert to the new mount API", v9fsapplyoptions applies parsed mount flags with |= onto flags already set by v9fssessioninit. For 9P2000.L,...