Important: Red Hat Security Advisory: python-urwid security update

An update for python-urwid is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator PRNG for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or,...

[SECURITY] [DLA 4757-1] openjdk-17 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4757-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort August 26, 2026 https://wiki.debian.org/LTS -...

CVE-2026-80567 Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Previously, rmif54bufferqueue waited for the worker thread to finish but ignored whether it succeeded. If the worker failed e.g., due to a timeout or register read...

CVE-2026-79072

A flaw was found in Google Chrome. A remote attacker could exploit improper state validation in the Performance component by crafting a malicious HTML page. This could potentially allow the attacker to read sensitive memory within the browser's sandbox, leading to information disclosure...

CVE-2026-79014

A flaw was found in Chromium's Autofill component. This race condition allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy. This bypass could enable the attacker to access or manipulate data from different web origins, potentially leading to...

CVE-2026-79013

A flaw was found in Google Chrome. Improper input validation in the Sync component allowed a remote attacker to obtain sensitive information. This could be achieved by sending specially crafted network traffic to a vulnerable system...

CVE-2026-78965

A flaw was found in ANGLE, a component used in Google Chrome. A remote attacker could exploit an uninitialized resource vulnerability by tricking a user into visiting a specially crafted HTML page. This could allow the attacker to obtain sensitive cross-origin data, leading to information...

CVE-2026-79208

A flaw was found in Chromium. Missing authorization in the HTTP2 protocol could allow a remote attacker to leak sensitive information. This vulnerability is exploited by crafting specific network traffic, leading to unauthorized disclosure of data...

CVE-2026-79206

A flaw was found in chromium-browser. An out-of-bounds read vulnerability in the FileSystem component allows a remote attacker to read memory outside of the sandbox. This can be exploited by leveraging social engineering to trick a user into visiting a specially crafted HTML page, leading to...

CVE-2026-79141

A flaw was found in Google Chrome Browser. This incorrect authorization vulnerability allows a remote attacker to bypass the web origin policy by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive information or actions within the browser...

CVE-2026-54553 Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

EUVD-2026-66559

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

CVE-2026-54553

Starlette-Admin , an administrative interface framework for FastAPI/Starlette applications, is affected by an unvalidated order_by parameter in its list API prior to 0.16.1 . The backend does not validate user-supplied order_by and structured where field names against the configured sortable_fiel...

CVE-2026-54553 Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

EUVD-2026-60382

Budibase authenticated arbitrary S3 signed upload URL issuance via /api/attachments/:datasourceId/url...

CVE-2026-13481 Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...

CVE-2026-13481 Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTPMGMTTIME management id. In tlvmgmtpostrecv, the PTPMGMTTIME case casts mgmttlv-data to a 10-byte struct ptptimestamp and reads it then byte-swaps and writes it back without first checking that the TLV data...

CVE-2026-13481

CVE-2026-13481 is an out-of-bounds read in the IEEE 1588 PTP management-message parser in Zephyr RTOS (subsys/net/lib/ptp/tlv.c). In tlv_mgmt_post_recv(), the PTP_MGMT_TIME case casts TLV data to a 10-byte ptp_timestamp struct without validating that the data field is at least that size, unlike a...

[SECURITY] [DLA 4756-1] openjdk-11 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4756-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort August 26, 2026 https://wiki.debian.org/LTS -...