SUSE-SU-2026:3472-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: - Update golang.org/x/net to v0.57....

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: Update golang.org/x/net to v0.57.0...

SUSE-SU-2026:3471-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: - Update golang.org/x/net to v0.57....

SUSE-SU-2026:23077-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...

CVE-2026-15383

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383

The CVE-2026-15383 entry concerns the Blog Floating Button WordPress plugin (versions up to and including 1.4.20). Affected component: the visitor User-Agent header is not sanitized/escaped when stored via an unauthenticated tracking REST endpoint and later rendered unescaped in an administrator ...

EUVD-2026-52174

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

[SECURITY] Fedora 43 Update: exim-4.99.5-1.fc43

Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal ...

CVE-2026-67307

Wazuh 5.0.0-beta1 is affected by a vulnerability in inventory-sync Start FlatBuffer messages where cluster_name and cluster_node are not validated or overridden, while agentid is validated. This enables a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerab...

EUVD-2026-51833

Wazuh 5.0.0-beta1 fixed in 5.0.0-beta3 does not validate or override the clustername and clusternode fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster...

CVE-2026-14197

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope...

WordPress Fluent Support plugin < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment vulnerability

Agent+ Arbitrary Ticket Customer Reassignment vulnerability discovered by Mustafa Ahmed in WordPress Plugin Fluent Support versions 2.3.1...

CVE-2026-14197

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope...

openSUSE 16 Security Update : google-guest-agent (openSUSE-SU-2026:21476-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21476-1 advisory. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege...

SUSE SLES15 Security Update : google-osconfig-agent (SUSE-SU-2026:3432-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3432-1 advisory. This update for google-osconfig-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject...

CVE-2026-55777

A flaw was found in GoAccess. A remote attacker can craft a malicious User-Agent string in an access log. The parseios function, which processes log data, incorrectly uses an attacker-controlled offset. This can lead to an out-of-bounds heap read, causing the application to crash and resulting in...

CVE-2026-54715

A flaw was found in GoAccess, a real-time web log analyzer. A remote attacker could exploit this vulnerability by providing a specially crafted User-Agent string in an access log. This improper handling by the parsebrowser function leads to a heap out-of-bounds write, a type of memory corruption...

SUSE-SU-2026:23073-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of...