CentOS Linux 8.4 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS8.4:CLSA-2025:1764321653)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1764321653 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the...

CentOS Linux 8 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS-STREAM8:CLSA-2025:1764321323)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1764321323 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into t...

CentOS Linux 6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-libs / bind-sdb / bind-utils (CENTOS6:CLSA-2026:1781169600)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1781169600 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1764084458)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764084458 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data...

CentOS Linux 7 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS7:CLSA-2026:1777287060)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777287060 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache...

CentOS Linux 8.5 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS8.5:CLSA-2025:1764584370)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1764584370 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the...

CVE-2026-96760

A flaw was found in authlib. This flaw allows a remote attacker to bypass digital signature verification and submit forged data. When processing a JSON Web Signature JWS, a format used to verify data integrity, the deserializejson function marks payloads as successfully verified without validatin...

EUVD-2026-39949

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN callback handler...

The vulnerability of SAML authentication in SAP NetWeaver AS ABAP and SAP NetWeaver ABAP software integration platforms allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of SAML authentication in SAP NetWeaver AS ABAP and SAP NetWeaver ABAP integration platforms is related to errors in verifying the cryptographic signature. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the service-monitor process. An attacker can manipulate monitoring results for services belonging to other users by submitting forged data as an authenticated agent. Remediation Upgrade...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the service-monitor process. An attacker can manipulate monitoring results for services belonging to other users by submitting forged data as an authenticated agent. Remediation Upgrade...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the service-monitor process. An attacker can manipulate monitoring results for services belonging to other users by submitting forged data as an authenticated agent. Remediation Upgrade...

CVE-2026-34182 CMS AuthEnvelopedData Processing May Accept Forged Messages

Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve...

Security Bulletin: IBM i is affected by BIND being too lenient accepting records with forged data and consuming excessive CPU when a resolver is performing DNSSEC validation [CVE-2025-40778, CVE-2026-1519].

Summary Domain Name System for IBM i is vulnerable to BIND being too lenient when accepting records from answers allowing an attack to inject forged data into cache CVE-2025-40778, and consuming excessive CPU when a resolver is performing DNSSEC validation and encounters a maliciously crafted zon...

CVE-2026-6272

A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest. 1. Obtain any valid token with only read scope. 2. Connect to the normal production gRPC API kuksa.val.v2. 3. Open...

EUVD-2026-25409

A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest. 1. Obtain any valid token with only read scope. 2. Connect to the normal production gRPC API kuksa.val.v2. 3. Open...

CVE-2026-6272

A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest. 1. Obtain any valid token with only read scope. 2. Connect to the normal production gRPC API kuksa.val.v2. 3. Open...

CVE-2026-6272: Missing Authentication for Critical Function

A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest. 1. Obtain any valid token with only read scope. 2. Connect to the normal production gRPC API kuksa.val.v2. 3. Open...

CVE-2026-4292 Privilege abuse in ModelAdmin.list_editable

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...

Linux Distros Unpatched Vulnerability : CVE-2026-4292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed...