Important: Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update

An update for sg3utils is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

RHEL 10 : sg3_utils (RHSA-2026:69124)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69124 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

Linux Distros Unpatched Vulnerability : CVE-2026-93753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target...

CVE-2026-93983

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects...

CVE-2026-93983 OpenPanel SQL Injection via ClickHouse Property Key Filter

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects...

CVE-2026-93983

OpenPanel (through commit bad75bdd ) contains a SQL injection vulnerability in its ClickHouse query layer. The root cause is a failure to escape property keys used in ClickHouse SQL queries, allowing an authenticated user to inject boolean SQL terms via crafted filter names. This enables attacker...

CVE-2026-93983 OpenPanel SQL Injection via ClickHouse Property Key Filter

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects...

EUVD-2026-83588

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects...

CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

UBUNTU-CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93752

CSSOM (versions through 0.5.0 ) contains a denial-of-service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. An attacker can supply a stylesheet containing a declaration named length , which replaces an internal counter and triggers excessive mem...

CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

EUVD-2026-83257

CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssTex...

CVE-2026-93753

deepmerge through version 4.3.1 is vulnerable to prototype poisoning in the mergeObject() function, which fails to properly validate keys written to target objects. An attacker can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned objec...

CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

EUVD-2026-83173

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Special:SearchByProperty process when user-supplied input in the property and value parameters is reflected into rendered output and error messages without sufficient output-context encoding. An attacker...