BIT-PHP-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

BIT-LIBPHP-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

CVE-2026-96573 Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escapin...

CVE-2026-96573 Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escapin...

CLEANSTART-2025-LU26051 Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution

Security vulnerability affects the exim package. Exim supports the use of multiple "-p" command line arguments which are malloc'ed and never free'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution...

CLEANSTART-2024-RH47389 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata

Security vulnerability affects the exiv2 package. Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata...

CLEANSTART-2024-YC31676 Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files

Security vulnerability affects the exiv2 package. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files...

CLEANSTART-2024-QN97923 Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files

Security vulnerability affects the exiv2 package. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files...

CLEANSTART-2026-PP37381 net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines

Security vulnerability affects the cri-tools package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines...

CentOS Linux 7 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql / etc (CENTOS7:CLSA-2026:1783707452)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1783707452 advisory. - A use-after-free in Exim 4.96 through 4.98.1 could allow users with command-line access to escalate privileges. CVE-2025-30232 - A use-after-fr...

Rocky Linux 8 [CIQ] Security Update: traceroute / traceroute-debuginfo / traceroute-debugsource (crlsa-2024_3211)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243211 advisory. traceroute: improper command line parsing CVE-2023-46316 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 9 [CIQ] Security Update: gnupg2 / gnupg2-debuginfo / gnupg2-debugsource / gnupg2-smime / etc (crlsa-2022_6602)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226602 advisory. gpg: Signature spoofing via status line injection CVE-2022-34903 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

Rocky Linux 9 [CIQ] Security Update: traceroute / traceroute-debuginfo / traceroute-debugsource (crlsa-2024_2483)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242483 advisory. traceroute: improper command line parsing CVE-2023-46316 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Security update for glib2 (moderate)

openSUSE security update: security update for glib2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21977-1 Rating: moderate References: bsc1272206 Cross-References: CVE-2026-15588 CVSS scores: CVE-2026-15588 SUSE : 5.3...

Rocky Linux 9.6 [TuxCare] Security Update: exiv2 / exiv2-devel / exiv2-doc / exiv2-libs (ALMALINUX9.6:CLSA-2026:1775221560)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775221560 advisory. - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to...

CentOS Linux 8 [TuxCare] Security Update: xterm / xterm-resize (CENTOS-STREAM8:CLSA-2026:1777030519)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1777030519 advisory. - xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command...

Rocky Linux 9 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc (crlsa-2026_6286)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266286 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly from...

Rocky Linux 8 [CIQ] Security Update: gnupg2 / gnupg2-debuginfo / gnupg2-debugsource / gnupg2-smime / etc (crlsa-2022_6463)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226463 advisory. gpg: Signature spoofing via status line injection CVE-2022-34903 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

CVE-2026-96573: Improper Neutralization of Input During Web Page Generation

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escapin...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_6285)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266285 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly from...