SUSE CVE-2026-53798

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

SUSE CVE-2026-75004

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesievedisabledactions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...

EUVD-2026-60559

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

CVE-2026-19608: Improper Authorization

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in...

sg3_utils security, bug fix, and enhancement update

1.44-6.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188162...

PT-2026-79850

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2//manifests/ endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has...

CVE-2026-67920: External Control of File Name or Path

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...

CVE-2026-18751: External Control of File Name or Path

External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App: 2607...

CVE-2026-50768

creationtimestamp| type| source ---|---|--- 2026-08-17 22:07:23+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtcpmk7xkz25 2026-08-17 22:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtcpreb54m24...

CVE-2026-66795

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

ANT-2026-J3EVXWDY · twigphp/Twig · code_injection

code-injection critical CVE-2026-46633 GHSA-7p85-w9px-jpjp Severity Claude high · Security research firm high · Maintainer critical Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Anvil Security. ANT-2026-J3EVXWDY:...

ANT-2026-FW0V6SAJ · dhis2-core · SQL Injection

sql-injection high CVE-2026-55084 GHSA-pwmg-mvjw-4m23 Severity Claude high · Security research firm high · Maintainer - REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ophion Security. ANT-2026-FW0V6SAJ: SQL Injection via Unquoted Column Name in...

MINI-GFX9-447R-Q2WH

Bulletin has no description...

MINI-2H8C-QGMR-7HCC

Bulletin has no description...

CVE-2026-75004

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesievedisabledactions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...

JLSEC-2026-1331

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used...

JLSEC-2026-1343 When saving HSTS data to an excessively long file name, curl could end up removing all contents,...

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use...

EUVD-2026-60170

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesievedisabledactions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...

CVE-2026-75004

In Roundcube Webmail, improper rule name quoting in the managesieve plugin allows a crafted Sieve rule name to bypass the managesieve_disabled_actions setting, letting users re-enable restricted Sieve actions (e.g., redirect, discard). Affects Roundcube <1.6.18 and 1.7.x

CVE-2026-75004

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesievedisabledactions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...