CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

EUVD-2026-51860

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

CVE-2025-15669 Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users such as administrators, who do not hold the unfilteredhtml capability on multisite to store JavaScript that...

CVE-2025-15669 Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users such as administrators, who do not hold the unfilteredhtml capability on multisite to store JavaScript that...

CVE-2025-15669

The Bit Form WordPress plugin, in versions prior to 3.1.4 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue stems from a failure to sanitize specific conversational-form display settings before they are rendered on a public-facing form. This allows high-privilege users, such ...

openSUSE 16: mcphost / mcphost-bash-completion / mcphost-fish-completion / etc (openSUSE-SU-2026:21480-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21480-1 advisory. - CVE-2026-5160: github.com/yuin/goldmark/renderer: Cross-site Scripting due to improper URL validation bsc1272488. - CVE-2026-39821:...

CVE-2026-10079

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...

CVE-2026-10079

Technical details are not publicly available in the provided documents. Monitor for updates. The description notes a deploy-time policy bypass via openshift.io/encoded-deployment-config label, but no further specifics are disclosed.

EUVD-2026-51508

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...

CVE-2026-10079 Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...

CVE-2026-10079

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...

CVE-2026-10079 Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...

CVE-2026-10079

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...

PT-2026-66735

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...

SUSE-SU-2026:3432-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of...

SUSE CVE-2026-35596

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, description...

SUSE CVE-2026-45781

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github./ namespace to OCI images the...

CVE-2026-66037

A flaw was found in FFmpeg. An uncontrolled resource consumption vulnerability exists in the IAMF demuxer. An unauthenticated attacker can exploit this by supplying a specially crafted input file with a malicious countlabel field. This can cause the system to allocate a large amount of memory,...

CVE-2026-14239

The tourmaster WordPress plugin (versions before 5.4.8 ) contains a stored Cross-Site Scripting (XSS) vulnerability triggered via CSRF . The flaw exists because the plugin fails to perform a nonce check when storing a custom-filter label from a request parameter and fails to escape the label when...

CVE-2026-14239 Tourmaster < 5.4.8 - Stored XSS via CSRF

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...