SUSE-SU-2026:23360-1 Security update for unbound

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency bsc1271879. - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget...

SUSE-SU-2026:23349-1 Security update for unbound

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency bsc1271879. - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget...

PT-2026-82252

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Cache poisoning...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104815)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104815 advisory. In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198...

CVE-2026-67275: Reliance on Insufficiently Trustworthy Component

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Cache poisoning...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: unbound (UTSA-2026-104836)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104836 advisory. In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104805)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104805 advisory. In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS...

TencentOS Server 3: unbound (TSSA-2026:0887)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0887 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-74932

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

CVE-2026-74932

WP Fastest Cache (WordPress plugin) versions before 1.5.1 fail to validate the Host header before using it to build URLs for asset files embedded in cached pages, and omit that header from the cache key. This allows an unauthenticated attacker to poison cached pages with references to an attacker...

EUVD-2026-65961

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

CVE-2026-74932 WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

CVE-2026-74932 WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.11 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.11 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

SUSE-SU-2026:3800-1 Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues: Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues fixed: - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures c...

EUVD-2026-65353

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...

PT-2026-81519

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

CVE-2026-74932: Improper Neutralization of Input During Web Page Generation

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

EUVD-2026-63564

django CMS: Page cache ignores plugin-declared Vary headers disclosure & poisoning...

GHSA-FWJF-M4QW-9F2X django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...