RHEL 10 / 8 / 9 : java-21-openjdk (RHSA-2026:42895)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42895 advisory. The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security...

PT-2026-63907

Unauthenticated Broken Access Control in Event post = 6.0.1 versions...

PT-2026-63882

Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...

PT-2026-64103

Summary Pillow's TGA RLE encoder reads past its row buffer when saving a mode "1" image. Adjacent process heap bytes can be copied into the generated TGA file. The bug is reachable through the public save API: python im.saveout, format="TGA", compression="tga rle" Older affected Pillow versions u...

PT-2026-63902

Contributor Local File Inclusion in Vino = 1.9 versions...

PT-2026-63929

Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...

PT-2026-63883

Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...

PT-2026-63821

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...

PT-2026-63885

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

EUVD-2024-55651

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...

n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

Impact The legacy MySQL v1 node's executeQuery operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. If a workflow uses this operation with expression-sourced values in the query and is connected to an externally-reachable trigger such as...

CVE-2026-3842 affecting package qemu for versions less than 9.1.0-11

CVE-2026-3842 affecting package qemu for versions less than 9.1.0-11. A patched version of the package is available...

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AFUNIX Address in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-haproxy | | Component |...

CVE-2025-50324

An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component...

UBUNTU-CVE-2025-50327

An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: kubernetes1.36: kubernetes1.36-1.36.2-6.1.hum1 aarch64, x8664 kubernetes1.36-client-1.36.2-6.1.hum1 aarch64, x8664 kubernetes1.36-kubeadm-1.36.2-6.1.hum1 aarch64, x8664...

WordPress Header Footer Script Adder plugin <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Header Footer Script Adder versions = 2.1...

WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Guillermo Álvarez in WordPress Plugin Shiptastic for WooCommerce versions = 5.1.0...