EUVD-2026-57170

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-19566

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...

UBUNTU-CVE-2026-68433

In the Linux kernel, the following vulnerability has been resolved: libceph: bound getversion reply decode to front len handlegetversionreply uses msg-frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size of the reused reply buffer, not the number of bytes actually receive...

UBUNTU-CVE-2026-68432

In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns vxlan-net. They differ once the device is created in or moved to a netns oth...

UBUNTU-CVE-2026-68441

In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TCACTREDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TCACTREDIRECT ex: via an eBPF program calling bpfredirect or an actbpf action, the redirect was silently lost i.e ...

UBUNTU-CVE-2026-68436

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time most of it the two inlined dcscratchspace copies and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual siz...

WordPress AI ANN PHP Object Injection Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress AI ANN suffers from a PHP object injection vulnerability. This vulnerability stems from improper handling of user input by the deserialization module, allowing attackers to inject...

CVE-2026-19654: Out-of-bounds Read

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code...

External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This...

CVE-2026-66379: Missing Authorization

An authenticated user may view private Puppet module metadata without repository read access...

SUSE SLED15: perl / perl-32bit / perl-base / perl-base-32bit / perl-core-DB_File / etc (SUSE-SU-2026:3558-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3558-1 advisory. - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bi...

CVE-2026-70560: Improper Neutralization of Input During Web Page Generation

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

PT-2026-71126

🚨 HIGH: CVE-2026-67587 in Apache Airflow 3.3.0 allows arbitrary module import via deserialization. CVSS 8.8. Upgrade to 3.3.1+ immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/XWZsAPG9T8...

The vulnerability of the functions __cdnsp_gadget_init() and cdnsp_gadget_exit() in the kernel module drivers/usb/cdns3/cdnsp-gadget.c of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the functions cdnspgadgetinit and cdnspgadgetexit in the kernel module drivers/usb/cdns3/cdnsp-gadget.c of the Linux operating system is related to memory initialization errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-71057

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-67260: Deserialization of Untrusted Data

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler. That sweep deserializes the task instance's nextkwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...

PT-2026-76591

Name of the Vulnerable Software and Affected Versions Drupal Quick Tabs versions 0.0.0 through 4.3.1 Description An incorrect authorization issue allows forceful browsing. The module fails to correctly enforce access when rendering node and block tabs by treating neutral access results as grants...

The vulnerability of the have_mon_and_osd_map() function in the net/ceph/ceph_common.c kernel module of the Linux operating system allows a hacker to induce a service failure.

The vulnerability of the havemonandosdmap function in the net/ceph/cephcommon.c kernel module of the Linux operating system is related to the dereferencing of a pointer with an expired lifetime. Exploiting this vulnerability could allow an attacker to trigger a service failure...

Vulnerability of the functions kvaser_usb_leaf_wait_cmd() and kvaser_usb_leaf_read_bulk_callback() in the kernel module drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c of the Linux operating system, which allows a hacker to cause a service failure

The vulnerabilities of the functions kvaserusbleafwaitcmd and kvaserusbleafreadbulkcallback in the kernel module drivers/net/can/usb/kvaserusb/kvaserusbleaf.c of the Linux operating system are related to the execution of a loop with an unreachable exit condition. Exploiting these vulnerabilities...

kernel security update

4.18.0-553.153.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...