[SECURITY] Fedora 43 Update: nsd-4.15.1-1.fc43

NSD is a complete implementation of an authoritative DNS name server. For further information about what NSD is and what NSD is not please consult the REQUIREMENTS document which is a part of this distribution...

CVE-2026-78620: External Control of File Name or Path

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

CVE-2026-62804: External Control of File Name or Path

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally...

EulerOS 2.0 SP12 : unbound (EulerOS-SA-2026-3391)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to...

CVE-2026-69805: External Control of File Name or Path

External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-68895: Numeric Truncation Error

Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally...

PT-2026-87151

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description A flaw in the JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. The issue occurs when a BSON document containing ...

CVE-2026-86669: Improper Authentication

A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now publi...

PT-2026-87040

Name of the Vulnerable Software and Affected Versions PX4 Autopilot versions prior to 1.17.1 Description The netman system command fails to validate the length of the interface name. An attacker can provide an interface name of 74 bytes or more using the -i option to trigger a stack buffer...

CVE-2026-69355: External Control of File Name or Path

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network...

PT-2026-88066

Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

EulerOS 2.0 SP12 : unbound (EulerOS-SA-2026-3316)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to...

PT-2026-88506

Impact The OAuth Dynamic Client Registration endpoints validated field sizes only for redirect uris, leaving client name and grant types bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have them persisted to the database...

CVE-2026-69383: External Control of File Name or Path

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

PT-2026-88281

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network...

PT-2026-87210

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally...

PT-2026-87395

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network...

CVE-2026-86542 knowns before 0.30.0 Path Traversal via Import Name

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the...

CVE-2026-86542 knowns before 0.30.0 Path Traversal via Import Name

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the...

CVE-2026-86542

knowns before version 0.30.0 contains a path traversal vulnerability in its import routes. The server fails to validate the name parameter, allowing an unauthenticated remote attacker to supply traversal sequences that escape the imports directory and overwrite arbitrary files writable by the ser...