PT-2026-49132

This update for rpcbind fixes the following issues Update to rpcbind 1.2.9: Security issue: - Fix several memory leaks and buffer overflows bsc1267212. Non security issue: - rpcbind fails to start tumbleweed snapshot 20181120 bsc1117217. Changes: rpcinfo: stack buffer overflow in rpcinfo...

PT-2026-46884

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1 Description A non-admin API user with integration:create ACL privilege can escalate their privileges to full administrator. This is possible by creating an integration wi...

PDF.js XSS

The vulnerability of the application for integrating PDF.js files with cloud-based software for creating and using data storage in NextCloud Server is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scriptin...

CVE-2026-7312

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to...

CVE-2026-46257 clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sp804: Fix an Oops when readcurrenttimer is called on ARM32 platforms where the SP804 is not registered as the schedclock. On SP804, the delay timer shares the same clkevt instance with schedclock. On so...

alcali (>=2018.3.2, <=2019.2.2), botbuilder-applicationinsights (>=4.7.0, <=4.14.2) +4 more potentially affected by CVE-2026-8404 via django (2.2.6)

django PYPI version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.2, =4.7.0, =4.10.0, =4.14.2 - kiwitcms 7.1.0 - ls-orb 0.1.0 - wazimap 2.1.0 Source cves: CVE-2026-8404 Source advisory:...

arches (>=6.2.5, <=7.4.2), botbuilder-applicationinsights (>=0.0.1, <=4.14.8) +3 more potentially affected by CVE-2026-8404 via django (3.2.21)

django PYPI version 3.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - arches =6.2.5, =0.0.1, =0.0.1, =2024.5.0, =2024.6.0 - nemo 4.6.4 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

org.apache.mina:mina-example (1.0.4), org.apache.mina:mina-filter-compression (1.0.4) +4 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.0.4)

org.apache.mina:mina-core MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.4 - org.apache.mina:mina-filter-compression 1.0.4 -...

org.apache.mina:mina-example (1.1.1), org.apache.mina:mina-filter-compression (1.1.1) +3 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.1.1)

org.apache.mina:mina-core MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.1.1 - org.apache.mina:mina-filter-compression 1.1.1 -...

org.apache.mina:mina-example (1.0.5), org.apache.mina:mina-filter-compression (1.0.5) +4 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.0.5)

org.apache.mina:mina-core MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.5 - org.apache.mina:mina-filter-compression 1.0.5 -...

org.apache.mina:mina-example (1.0.7), org.apache.mina:mina-filter-codec-netty (1.0.7) +5 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.0.7)

org.apache.mina:mina-core MAVEN version 1.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.7 - org.apache.mina:mina-filter-codec-netty 1.0.7 -...

org.apache.mina:mina-example (1.0.10), org.apache.mina:mina-filter-codec-netty (1.0.10) +5 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.0.10)

org.apache.mina:mina-core MAVEN version 1.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.10 - org.apache.mina:mina-filter-codec-netty 1.0.10 -...

org.apache.mina:mina-example (1.0.3), org.apache.mina:mina-filter-compression (1.0.3) +4 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.0.3)

org.apache.mina:mina-core MAVEN version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.3 - org.apache.mina:mina-filter-compression 1.0.3 -...

org.apache.mina:mina-example (1.0.6), org.apache.mina:mina-filter-codec-netty (1.0.6) +5 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.0.6)

org.apache.mina:mina-core MAVEN version 1.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.6 - org.apache.mina:mina-filter-codec-netty 1.0.6 -...

Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting 32 maliciously modified packages across more than 90 versions under the @redhat-cloud-services npm scope. The...

Microsoft Build 2026: Securing code, agents, and models across the development lifecycle

In this article 1. Secure your code 2. Secure your agents 3. Trust agents with your data 4. Secure your models 5. Trust starts with security Today, developers and security teams are caught in growing tension. AI is accelerating development and introducing new issues around insecure code, opaque...

CVE-2026-37233

FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eqxappricgenid in src/ric/iApp/xappricid.c compares m0-xappid against itself m0-xappid instead of the other argument m1-xappid, effectively ignoring the xApp identity dimension. A malicio...

CVE-2026-7313 CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with...

CVE-2026-7312 CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to...

CVE-2026-7312

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to...