PT-2026-56261

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.0-beta4 Description The HTTP-tool OpenAPI schema importer validates only the top-level URL before passing it to SwaggerParser.bundle. The remote reference resolver within this bundle fetches $ref URLs without...

RHEL 9 : kernel (RHSA-2026:36018)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36018 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fs/smb/client: fix...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 kernel: netfilter: nfnetlinkcthelper: fix OOB read in nfnlcthelperdumptable CVE-2026-43450 kernel: sctp: revalidate list cursor...

kernel security, bug fix, and enhancement update

5.14.0-687.19.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 kernel: netfilter: nfnetlinkcthelper: fix OOB read in...

PT-2026-56247

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24 Description The '/de2api/datasetData/previewSql' endpoint lacks the mandatory @DePermit permission validation annotation. This allows any authenticated user to set the datasourceId variable to -1, granting...

PT-2026-56264

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to v4.15.0-beta5 Description Two file handlers fail to verify if a requested S3 object key belongs to the caller's team. Since S3 object keys are global within a bucket and only include the tenant ID as a path segment, a...

PT-2026-56265

Name of the Vulnerable Software and Affected Versions OpenWrt versions prior to 25.12.5 Description An integer underflow occurs in the handle send a function of the Emergency Access Daemon. An unauthenticated attacker on the local network can trigger this by sending a single crafted UDP packet,...

Medium: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of "old" filters before change CVE-2026-53080 Affected Packages: kernel6.12 Issue Correction: Run dnf update kernel6.12 --releasever 2023.12.20260706 or dnf update --advisory...

python3.14-pip security update

25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion + remove unused metadata file 25.2-4 - Security fix for CVE-2026-8643: path traversal in wheel entry points...

postgresql:18 security update

pgaudit 18.0-1 - Update to 18.0 - Initial import for postgresql18 pgrepack 1.5.3-1 - Update to 1.5.3 - Initial import for postgresql18 1.5.1-1 - Update to v1.5.1 1.4.8-2 - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604 pgvector 0.8.1-1 - Update to 0.8.1 - Initial...

sdbootutil-1+git20260706.f9f4faf-1.1 on GA media (moderate)

sdbootutil-1+git20260706.f9f4faf-1.1 on GA media Announcement ID: openSUSE-SU-2026:11194-1 Rating: moderate Cross-References: CVE-2026-41676 CVSS scores: CVE-2026-41676 SUSE : 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2026-41676 SUSE : 8.3...

Fedora 45 : cifs-utils (2026-90dbff48ca)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-90dbff48ca advisory. Automatic update for cifs-utils-7.6-2.fc45. Changelog Mon Jul 6 2026 Paulo Alcantara - 7.6-2 - cifs.upcall: fix regression with kerberos mounts - Resolves:...

ALSA-2026:36196 Important: 389-ds-base security update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: Heap buffer overflow in sasliorecv via padded SASL...

Important: python3.12

Issue Overview: The "tarfile" module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other...

ALSA-2026:36349 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 kernel: netfilter: nfnetlinkcthelper: fix OOB read in nfnlcthelperdumptable CVE-2026-43450 kernel: sctp: revalidate list cursor...

CVE-2026-53644

FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets for orders that are no longer in an active state e.g., suspended, canceled. The root cause is missing order-state...

CVE-2026-53646 FOSSBilling: Client password reset token reuse allows persistent account takeover

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a ClientPasswordReset record already exists for a client from a previous unexpired reset request, subsequent calls to the resetpassword guest API endpoint reuse the existing token instea...

CVE-2026-53644

CVE-2026-53644 (FOSSBilling) : Versions 0.5.3–0.7.2 allow authenticated clients to read and reset API key service secrets for orders not in an active state due to missing order-state validation in two client API endpoints, despite an isActive() helper existing in the Serviceapikey module. The iss...

[slackware-security] c-ares

New c-ares packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/c-ares-1.34.7-i586-1slack15.0.txz: Upgraded. This release fixes the following security issues: Use-after-free / double-free in c-ares'...