SUSE-SU-2026:4067-1 Security update for NetworkManager

This update for NetworkManager fixes the following issues: - CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. - CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation...

Security update for NetworkManager

This update for NetworkManager fixes the following issues: CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass...

SUSE-SU-2026:4066-1 Security update for NetworkManager

This update for NetworkManager fixes the following issues: - CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. - CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation...

Security update for NetworkManager

This update for NetworkManager fixes the following issues: CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass...

Security update for php-composer2

This update for php-composer2 fixes the following issue: CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL bsc1278257. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you...

SUSE-SU-2026:4059-1 Security update for php-composer2

This update for php-composer2 fixes the following issue: - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL bsc1278257...

Important: Red Hat Security Advisory: git-lfs security update

An update for git-lfs is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

PT-2026-87190

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...

CVE-2026-86738: Improper Neutralization of Input During Web Page Generation

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-75726: Improper Input Validation

Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue require...

PT-2026-87188

Impact The OAuth token endpoint bound an authorization code's first access token to the consented resource, but not its refresh token. Refreshing only checked that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could refres...

PT-2026-87180

A url redirection to untrusted site 'open redirect' vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands via...

CVE-2026-73019: Improper Resolution of Path Equivalence

Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-87928

Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...

RHEL 10 : git-lfs (RHSA-2026:64788)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:64788 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...

AlmaLinux 10 : git-lfs (ALSA-2026:64788)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:64788 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial o...