libvirt security update

11.10.0-12.3.0.1 - Set SOURCEDATEEPOCH from changelog Orabug: 32019554 11.10.0-12.3.el98 - cpuconf: Introduce virCPUDefSortFeatures RHEL-178822 - qemucapabilities: Split virQEMUCapsFillDomainCPUCaps RHEL-178822 - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel RHEL-1788...

CVE-2026-49839

A flaw was found in jq, a command-line JSON processor. This vulnerability allows an attacker to trigger a heap out-of-bounds write by providing a specially crafted, oversized file to the jq --rawfile option. This can lead to a denial of service DoS, making the affected system or application...

curl: setopt(VERIFYPEER) from callback bypasses TLS verify on connection reuse

Summary: Curlsslconnconfigupdate overwrites conn-sslconfig.verifypeer when curleasysetoptCURLOPTSSLVERIFYPEER, ... is called, with no handshake-state guard — only ifdata-conn. Since setopt is documented as callable from callbacks setopt.c:2930, an application can connect with verifypeer=0 accepti...

Remote unauthenticated attackers able to upload files in Onionshare

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality...

PYSEC-2026-376 Langflow has Remote Code Execution in CSV Agent

Summary The CSV Agent node in Langflow hardcodes allowdangerouscode=True, which automatically exposes LangChain’s Python REPL tool pythonreplast. As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution RCE...

PYSEC-2026-500 pymetasploit3 vulnerable to command injection in console.run_module_with_output()

Command injection vulnerability in console.runmodulewithoutput in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended...

vim: arbitrary command execution via modeline sandbox bypass

A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the complete, guitabtooltip, printheader options and the mapset function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution...

Linux Distros Unpatched Vulnerability : CVE-2026-56114

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6makemessage in src/dhcp6.c that allows...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the getImportedVocabFile function in the tokenVocab Grammar Option Handler. An attacker can access arbitrary files on the system by supplying crafted input paths. Details A Directory Traversal attack also known a...

CVE-2026-13503: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be...

Linux Distros Unpatched Vulnerability : CVE-2026-42004

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist's filtering rules, but will be rewritten as a valid OPT record when EDNS Client...

Linux Distros Unpatched Vulnerability : CVE-2026-53099

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Switch CONFIGCFICLANG to CONFIGCFI This was renamed in commit 23ef9d439769 kcfi: Rename...

netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

...

radvdump's Route Information Option Parser has a Stack Buffer Overflow

...

netfilter: ip6t_hbh: reject oversized option lists

...

SUSE CVE-2026-49839

jq is a command-line JSON processor. Prior to 1.8.2, jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jvloadfileraw=1 reads an attacker-controlled file, it repeatedly appends file chunks to the...

GHSA-J989-F892-2335 ImageMagick: Memory Leak in wand option parser when providing invalid arguments

When providing invalid options to the wand option parser a small memory leak will occur...

ImageMagick: Memory Leak in wand option parser when providing invalid arguments

When providing invalid options to the wand option parser a small memory leak will occur...

EUVD-2026-36191

ImageMagick: Memory Leak in wand option parser when providing invalid arguments...

GHSA-P4XF-RF54-RJ3X pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

Summary pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as...