CVE-2026-71240 DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter

DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...

CVE-2026-71240

DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...

MAL-2026-12136 Malicious code in accounts-stores (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c70d8323b295e6b8dfa18e720a7b6e2a719c42d19a5dedab1157866043417c7d The package advertises itself as a reactive state-management library but its index.js silently requires./setup at the end of module load inside a...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected affected by a server-side request forgery vulnerability (CVE-2026-11546)

Summary IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test...

Malicious code in bcore-bravo-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe55f411284226c68e60cbcae266a390a3ba0ef089a2a709363df3188130f605 The package presents itself as an ESLint config / 'environment config reader' but on require executes an import-time dropper. index.js ends with try...

kernel security, bug fix, and enhancement update

4.18.0-553.151.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

PT-2026-68106

Name of the Vulnerable Software and Affected Versions DjangoCRM affected versions not specified Description The toggle default sorting view in common/urls.py lacks authentication wrappers such as login required or staff member required. The view redirects to a destination specified by the next ur...

CVE-2026-24078

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...

Malicious code in @onereach/or-browser-next (npm)

npm/@onereach/or-browser-next is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11609 Malicious code in @onereach/or-browser-next (npm)

npm/@onereach/or-browser-next is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in conv-context-next (npm)

npm/conv-context-next is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

MAL-2026-11965 Malicious code in conv-context-next (npm)

npm/conv-context-next is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

CVE-2026-24078

Technical details about CVE-2026-24078 are not publicly available in the provided documents. Monitor for updates from official bulletins.

EUVD-2026-52731

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...

CVE-2026-24078 Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...

CVE-2026-24078 Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...

Security update for bind

This update for bind fixes the following issues CVE-2026-11622: Potential memory usage beyond configured limits bsc1271986. CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards bsc1271987. CVE-2026-13204: Unexpected exit in certain situations with NSEC and...

SUSE-SU-2026:3484-1 Security update for bind

This update for bind fixes the following issues - CVE-2026-11622: Potential memory usage beyond configured limits bsc1271986. - CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards bsc1271987. - CVE-2026-13204: Unexpected exit in certain situations with NSEC...

Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: AlmaLinux8.10 - KVM: s390: Limit adapter indicator access to mapped page JIRA:AlmaLinux-18388...

Moderate: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: AlmaLinux8.10 - KVM: s390: Limit...