CVE-2026-85229

Apache SkyWalking UI versions 10.2.0 through 10.4.0 are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the Booster UI dashboard widgets . This issue is characterized as an incomplete fix of CVE-2025-54057, involving the improper neutralization of input during web page...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.98.0-1.hum1 aarch64, x8664 clippy-1.98.0-1.hum1 aarch64, x8664 rust-1.98.0-1.hum1 aarch64, x8664 rust-analyzer-1.98.0-1.hum1 aarch64, x8664 rust-debugger-common-1.98.0-1.hum1 noarch...

EUVD-2025-210844

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

CVE-2025-15691

The WPFunnels WordPress plugin, in versions before 3.13.0 , contains an authentication bypass vulnerability. The plugin fails to verify if user registration is enabled on the site before creating accounts from opt-in form submissions, incorrectly relying on a value provided within the request. Th...

CLEANSTART-2026-XF15574 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the octo-sts package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

PT-2026-86429

Name of the Vulnerable Software and Affected Versions gRPC-Go versions prior to 1.82.2 gRPC-Go versions prior to 1.83.2 Description Servers created with xds.NewGRPCServer are susceptible to a Denial of Service DoS because the HTTP/2 server transport may accept RPCs missing both the :authority...

Linux Distros Unpatched Vulnerability : CVE-2026-84451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full- item branch of...

OPENSUSE-SU-2026:11691-1 trivy-0.74.0-3.1 on GA media

These are all security issues fixed in the trivy-0.74.0-3.1 package on the GA media of openSUSE Tumbleweed...

Fedora 43 : kernel (2026-a7b1ccd14c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a7b1ccd14c advisory. The 7.1.13 stable kernel update contains a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream...

RHEL 7 : kernel-rt (RHSA-2026:63539)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:63539 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements...

PT-2026-85744

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

Linux Distros Unpatched Vulnerability : CVE-2026-85393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed...

PT-2026-85404

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

UBUNTU-CVE-2026-84450

Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read...

OPENSUSE-SU-2026:11679-1 agama-24+0.a836cced5-54.1 on GA media

These are all security issues fixed in the agama-24+0.a836cced5-54.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-76925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Flatpak. A Time-of-check to time-of-use TOCTOU race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerabili...

Linux Distros Unpatched Vulnerability : CVE-2026-71198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import...

Linux Distros Unpatched Vulnerability : CVE-2026-84732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that...

UBUNTU-CVE-2026-84451

Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: redis (UTSA-2026-106458)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106458 advisory. Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK...