vim security update

9.1.083-9.0.1.el102.12 - Remove upstream references Orabug: 31197557 2:9.1.083-9.12 - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion 2:9.1.083-9.11 - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution during C omni-completion 2:9.1.083-9.10 -...

PT-2026-66607

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The software fails to perform ownership or session checks when looking up sequential orderId...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30701)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from the ESI plugin’s failure to properly handle recursive requests. Attackers can exploit...

PT-2026-66393

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

Oracle Linux 10 : vim (ELSA-2026-48650)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-48650 advisory. - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution...

Apache Traffic Server encryption vulnerability

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is an encryption-related vulnerability in Apache Traffic Server. This vulnerability stems from the certifier plugin generating certificates based on the client SNI...

PT-2026-66606

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The payment webhook at the POST / locale/update-payment endpoint accepts the id and orderId...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30694)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from improper handling of object lifecycle in the intercept plugin. Currently, no detailed...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30692)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a buffer overflow vulnerability, which stems from the Multiplexer plugin failing to properly handle upstream inputs. Attackers can exploit this...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30699)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a buffer overflow vulnerability, which stems from the improper handling of inputs by the txnbox plugin controlled by attackers. Attackers can exploi...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30697)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from the improper handling of initialization, transform contexts, and per-instance state by...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30695)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a buffer overflow vulnerability in Apache Traffic Server. This vulnerability stems from the headerrewrite plugin’s improper handling of memory during cookie operatio...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30700)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a buffer overflow vulnerability, which stems from improper handling of substitute inputs by the regexremap plugin. Attackers can exploit this...

RHEL 9 : grafana-pcp (RHSA-2026:47716)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:47716 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

WordPress Subscriptions for WooCommerce plugin <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation vulnerability

Missing Authorization to Authenticated Shop Manager+ Arbitrary Plugin Installation vulnerability discovered by Wordfence PRISM in WordPress Plugin Subscriptions for WooCommerce versions = 2.0.0...

CVE-2026-56852 affecting package sriov-network-device-plugin for versions less than 3.7.0-7

CVE-2026-56852 affecting package sriov-network-device-plugin for versions less than 3.7.0-7. A patched version of the package is available...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.

Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release. Red Hat Developer Hub RHDH is extensible by the plugins included herein...

Logging operator has Fluentd configuration injection that allows remote code execution

Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...

GHSA-MJQF-28PH-426H Logging operator has Fluentd configuration injection that allows remote code execution

Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...

WordPress المنتور فارسی plugin <= 2.8.1 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Chiao-Lin Yu Steven Meow in WordPress Plugin المنتور فارسی versions = 2.8.1...