OESA-2026-4339 hplip security update

The Hewlett-Packard Linux Imaging and Printing Project provides drivers for HP printers and multi-function peripherals. Security Fixes: A flaw was found in HPLIP HP Linux Imaging and Printing Software. This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalat...

OESA-2026-4337 hplip security update

The Hewlett-Packard Linux Imaging and Printing Project provides drivers for HP printers and multi-function peripherals. Security Fixes: A flaw was found in HPLIP HP Linux Imaging and Printing Software. This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalat...

OESA-2026-4336 hplip security update

The Hewlett-Packard Linux Imaging and Printing Project provides drivers for HP printers and multi-function peripherals. Security Fixes: A flaw was found in HPLIP HP Linux Imaging and Printing Software. This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalat...

Exploit for CVE-2026-79983

CVE-2026-79983 — camel-ftp: consumer builds the remote path fr...

CVE-2026-97205

A flaw was found in NGINX. In certain configurations using asynchronous file I/O and SSI pages with include virtual commands, request processing can access freed memory in a worker process. A remote attacker may trigger memory corruption or a worker crash. Arbitrary code execution may be possible...

WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin Advanced File Manager versions = 5.4.14...

Exploit for CVE-2026-78163

CVE-2026-78163 — camel-docling: unvalidated body input source...

CVE-2026-111311

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...

BIT-GITLAB-2026-1403 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

Kwetsbaarheid verholpen in BeyondTrust Remote Support

BeyondTrust has discovered a critical vulnerability in BeyondTrust Remote Support. This vulnerability, identified as CVE-2026-102764, has a CVSS score of 9.3. It involves insufficient validation of the origin of messages within the product’s internal components. As a result, a malicious actor...

BIT-MYSQL-CLIENT-2026-107818 MariaDB: environment injection via wsrep bootstrap in the mariadb.service file

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

BIT-MYSQL-CLIENT-2026-107814 MariaDB: Insecure $HOME in MariaDB rpm packages

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-86420: Denial of Service due to memory budget exhaustion bsc1279696. CVE-2026-86421: Denial of Service via memory leak in MSL decoder bsc1279711. CVE-2026-86423: Denial of service via heap-use-after-free in PerlMagick's GetList meth...

BIT-MARIADB-MIN-2026-107818 MariaDB: environment injection via wsrep bootstrap in the mariadb.service file

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

BIT-MARIADB-MIN-2026-107814 MariaDB: Insecure $HOME in MariaDB rpm packages

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

BIT-MARIADB-2026-107818 MariaDB: environment injection via wsrep bootstrap in the mariadb.service file

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

BIT-MARIADB-2026-107814 MariaDB: Insecure $HOME in MariaDB rpm packages

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

CVE-2026-111311

The DoubleScale | All-in-One CRM plugin for WordPress (versions up to and including 1.5.1 ) is vulnerable to Arbitrary File Upload via the store_upload function. The root cause is a fail-open extension allow-list in extension_is_allowed() which returns true when wp_check_filetype() yields an empt...

CVE-2026-111311 DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...

CVE-2026-111311 DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...