EUVD-2026-78944

In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-79157

In gftatestsetconfig of gftatest.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0199

In gftatestsetconfig of gftatest.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0199

In gftatestsetconfig of gftatest.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0199

In gftatestsetconfig of gftatest.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Low: Red Hat Security Advisory: rsyslog security update

An update for rsyslog is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code...

CVE-2026-68534

Concrete CMS before 9.5.3 contained a stored cross-site scripting (XSS) vulnerability caused by Express entry labels being rendered as raw HTML in association selectors. An unauthenticated attacker could submit a malicious payload through a public Express Form, which would then execute in an admi...

CVE-2026-13210

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

CVE-2026-11934

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input...

CVE-2026-12355

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation,...

CVE-2026-11926

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-81899 Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

CVE-2026-56831

Shopper Framework (package shopper/framework), a headless e-commerce admin panel, is vulnerable to a business logic flaw (CWE-20) in versions prior to 2.9.0 . The /cpanel/discounts administrative interface accepts negative fixed_amount discount values without server-side validation, persisting th...

CVE-2026-56831 Shopper: Negative discount values accepted and propagated through order calculation pipeline

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixedamount discount values, persists them in shdiscounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and...

CVE-2026-13210

GitLab CE/EE is affected by an improper input validation flaw in the environment scope pattern matcher for CI/CD variables. An authenticated user could access CI/CD variables outside their intended environment scope under certain conditions. The issue affects versions from 15.7 before 19.1.8 , 19...

EUVD-2026-78908

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

CVE-2026-18113

Concrete CMS 9.0 through 9.5.2 is affected by a stored cross-site scripting (XSS) vulnerability in the Top Navigation Bar block . The block failed to HTML-escape dropdown child page names before rendering them into the page, allowing a user with page-creation or renaming privileges to inject a sc...

CVE-2026-45579 DIRAC: RCE in RequestManager due to eval on untrusted input

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py exportgetRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to...

CVE-2026-11926 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...