EulerOS 2.0 SP10 : containerd (EulerOS-SA-2026-3686)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels...

EulerOS 2.0 SP10 : containerd (EulerOS-SA-2026-3733)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels...

Linux Distros Unpatched Vulnerability : CVE-2026-90403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path in rtlpciprobe, the cleanup functions are skipped due to a wrong goto label. Moreover,...

DEBIAN-CVE-2026-90403

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path in rtlpciprobe, the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtlinitrfkill, ieee80211registerhw,...

CVE-2026-90403

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path in rtlpciprobe, the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtlinitrfkill, ieee80211registerhw,...

CVE-2026-90403

CVE-2026-90403 affects the Linux kernel's rtlwifi PCI driver . In the last error path of rtl_pci_probe(), a wrong goto label causes cleanup functions to be skipped, leaving previously successful calls to rtl_init_rfkill(), ieee80211_register_hw(), and rtl_debug_add_one() unreverted. The fix updat...

CVE-2026-90403 wifi: rtlwifi: pci: fix error path in rtl_pci_probe()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path in rtlpciprobe, the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtlinitrfkill, ieee80211registerhw,...

CVE-2026-90403 wifi: rtlwifi: pci: fix error path in rtl_pci_probe()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path in rtlpciprobe, the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtlinitrfkill, ieee80211registerhw,...

CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-81896 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

CVE-2026-81896 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

CVE-2026-81896 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report concrete/singlepages/dashboard/reports/forms/legacy.php. a rogue editor could store markup or script in a label...

CVE-2026-55887

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-55636

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...

CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

EUVD-2026-78684

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-55887

Docker MCP Gateway (versions 0.21.0 through 0.42.2) is vulnerable to an argument injection via the io.docker.server.metadata OCI image label. The label is YAML-unmarshalled into the broad catalog.Server struct, and runtime-shaping fields such as Volumes , User , and ExtraHosts are appended verbat...

CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...