Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.3: rabbitmq-server4.3-4.3.6-1.1.hum1 aarch64, s390x, x8664 rabbitmq-server4.3-4.3.6-1.1.hum1.src src...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: hugo: hugo-0.168.0-0.1.hum1 aarch64, s390x, x8664 hugo-0.168.0-0.1.hum1.src src...

RAW image plugin Heap Buffer Overflow RCE

The vulnerability of the plugin for viewing RAW images is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

UBUNTU-CVE-2017-20286

DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette in ilgif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing ...

CVE-2017-20286: Out-of-bounds Write

DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette in ilgif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing ...

PT-2026-113718

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post images file info2 = title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: poppler: poppler-26.08.0-1.5.hum1 aarch64, s390x, x8664 poppler-cpp-26.08.0-1.5.hum1 aarch64, s390x, x8664 poppler-cpp-devel-26.08.0-1.5.hum1 aarch64, s390x, x8664 poppler-devel-26.08.0-1.5.hum1...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: gdb: gdb-17.2-6.2.hum1 aarch64, s390x, x8664 gdb-doc-17.2-6.2.hum1 noarch gdb-gdbserver-17.2-6.2.hum1 aarch64, s390x, x8664 gdb-headless-17.2-6.2.hum1 aarch64, s390x, x8664...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: gnupg2: gnupg2-2.4.9-18.3.hum1 aarch64, s390x, x8664 gnupg2-dirmngr-2.4.9-18.3.hum1 aarch64, s390x, x8664 gnupg2-g13-2.4.9-18.3.hum1 aarch64, s390x, x8664 gnupg2-gpg-agent-2.4.9-18.3.hum1 aarch64...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: qt6-qtbase: qt6-qtbase-6.11.2-3.1.hum1 aarch64, s390x, x8664 qt6-qtbase-common-6.11.2-3.1.hum1 noarch qt6-qtbase-devel-6.11.2-3.1.hum1 aarch64, s390x, x8664 qt6-qtbase-examples-6.11.2-3.1.hum1...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: binutils: binutils-2.46.1-1.4.hum1 aarch64, s390x, x8664 binutils-devel-2.46.1-1.4.hum1 aarch64, s390x, x8664 binutils-gold-2.46.1-1.4.hum1 aarch64, s390x, x8664 binutils-gprofng-2.46.1-1.4.hum1...

CVE-2026-105445

An Incorrect Privilege Assignment vulnerability in Docker Hub 's account-to-organization conversion feature allows an authenticated attacker to reassign a personal access token (PAT) they control to another user. Because the token secret remains unchanged during this reassignment, the attacker ca...

SUSE CVE-2026-109268

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused,...

CVE-2026-85733

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo. A derived image that does not overwrite this placeholder serves the diagnostics page in production and can...

CVE-2026-85733 FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo. A derived image that does not overwrite this placeholder serves the diagnostics page in production and can...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: openssh: openssh-10.5p1-1.2.hum1 aarch64, s390x, x8664 openssh-askpass-10.5p1-1.2.hum1 aarch64, s390x, x8664 openssh-clients-10.5p1-1.2.hum1 aarch64, s390x, x8664 openssh-keycat-10.5p1-1.2.hum1...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.42 bug fix and security update

Red Hat OpenShift Container Platform release 4.20.42 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

BIT-GHOST-2026-105644 Ghost: Stored XSS via SVG Files in Content Imports

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff...

CVE-2026-105445: Incorrect Privilege Assignment

An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token PAT they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then...

PT-2026-111670

Name of the Vulnerable Software and Affected Versions Docker Hub affected versions not specified Description An authentication bypass flaw in the management of Personal Access Tokens PAT allowed attackers to impersonate users and organizations. An attacker could create a personal account, generat...