CVE-2026-40484 ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory, which performs no file...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby4.0: ruby4.0-4.0.0-33.3.hum1 aarch64, x8664 ruby4.0-bundled-gems-4.0.0-33.3.hum1 aarch64, x8664 ruby4.0-default-gems-4.0.0-33.3.hum1 noarch ruby4.0-devel-4.0.0-33.3.hum1 aarch64, x8664...

Directory Traversal

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal in the handling of Discord event cover image parameters, which could bypass the intended media normalization. An attacker can access host-local media references by...

OpenClaw: Discord event cover images bypassed sandbox media normalization

Summary Discord event cover images bypassed sandbox media normalization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.7 = 2026.4.10 Impact Discord event cover image parameters could bypass the sandbox media normalization path used for outbound...

WordPress Categories Images plugin <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Categories Images versions = 3.3.1...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.12: python3.12-3.12.13-3.hum1 aarch64, x8664 python3.12-debug-3.12.13-3.hum1 aarch64, x8664 python3.12-devel-3.12.13-3.hum1 aarch64, x8664 python3.12-idle-3.12.13-3.hum1 aarch64, x8664...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.11: python3.11-3.11.15-4.hum1 aarch64, x8664 python3.11-debug-3.11.15-4.hum1 aarch64, x8664 python3.11-devel-3.11.15-4.hum1 aarch64, x8664 python3.11-idle-3.11.15-4.hum1 aarch64, x8664...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: cups: cups-2.4.17-1.hum1 aarch64, x8664 cups-client-2.4.17-1.hum1 aarch64, x8664 cups-devel-2.4.17-1.hum1 aarch64, x8664 cups-filesystem-2.4.17-1.hum1 noarch cups-ipptool-2.4.17-1.hum1 aarch64,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: mariadb11.8: mariadb-11.8.6-2.2.hum1 aarch64, x8664 mariadb-backup-11.8.6-2.2.hum1 aarch64, x8664 mariadb-client-utils-11.8.6-2.2.hum1 noarch mariadb-common-11.8.6-2.2.hum1 noarch...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: mariadb10.11: mariadb10.11-10.11.16-2.2.hum1 aarch64, x8664 mariadb10.11-backup-10.11.16-2.2.hum1 aarch64, x8664 mariadb10.11-client-utils-10.11.16-2.2.hum1 noarch...

JLSEC-2026-149

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, the DWA lossy decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. Fo...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: postgresql18: postgresql-18.3-1.2.hum1 aarch64, x8664 postgresql-contrib-18.3-1.2.hum1 aarch64, x8664 postgresql-docs-18.3-1.2.hum1 aarch64, x8664 postgresql-plperl-18.3-1.2.hum1 aarch64, x8664...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: haproxy: haproxy-3.0.19-1.1.hum1 aarch64, x8664 haproxy-3.0.19-1.1.hum1.src src...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: haproxy: haproxy-3.0.19-1.hum1 aarch64, x8664 haproxy-3.0.19-1.hum1.src src...

[SECURITY] Fedora 43 Update: skopeo-1.22.2-1.fc43

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...

[SECURITY] Fedora 43 Update: podman-5.8.2-1.fc43

podman Pod Manager is a fully featured container engine that is a simple daemonless tool. podman provides a Docker-CLI comparable command line that eases the transition from other container engines and allows the management of pods, containers and images. Simply put: alias docker=3Dpodman. Most...

[SECURITY] Fedora 43 Update: buildah-1.43.1-1.fc43

The buildah package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a ne...

PT-2026-33532

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory, which performs no file...

Anviz CX7 安全漏洞

The Anviz CX7 is an intelligent terminal device from the American company Anviz, featuring integrated biometrics and access control functions. The Anviz CX7 has a security vulnerability; this vulnerability stems from the ability to retrieve recently captured test photos without authentication,...

SUSE CVE-2026-40192

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of...