SUSE-SU-2026:3507-1 Security update for pcp

This update for pcp fixes the following issues: - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. - CVE-2026-16527: missing...

Security update for pcp

This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...

SUSE-SU-2026:3506-1 Security update for pcp

This update for pcp fixes the following issues: - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. - CVE-2026-16527: missing...

Security update for pcp

This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...

MAL-2026-12790 Malicious code in glia-functions-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f6c700225d22dcccdf1af7bb58c7628366ccc59b864431af5123909b42626 package.json's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, and current working directory, reads...

MAL-2026-12787 Malicious code in dynstrg-howto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 800fab99d95f1a2cef6ebf269ca240bf60518735cfb58c7c24b6a8474c72ee77 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

Malicious code in dynstrg-howto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 800fab99d95f1a2cef6ebf269ca240bf60518735cfb58c7c24b6a8474c72ee77 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

MAL-2026-12513 Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

CVE-2026-71192

CVE-2026-71192 affects OpenStack Swift up to version 2.38.0, where the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) in S3 API requests when the non-default configuration s3_acl=true is used. An attacker can inject these headers into a signed P...

Malicious code in add-two-numbers-x7q9m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 550dfc48a74577d95e53fc64cc296a9cc59a5940edb6eac3f191f41376350635 The package advertises itself as a trivial 'add two numbers' utility but its preinstall lifecycle script enumerates the installer's Desktop directory...

Oracle Linux 8 : mingw-glib2 (ELSA-2026-49512)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49512 advisory. - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves:...

CVE-2026-18759 An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

Important: perl-YAML-Syck

Issue Overview: YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syckhdlraddanchor and syckhdlrremoveanchor free the node stored unde...

SUSE SLES12 Security Update : perl-DBI (SUSE-SU-2026:3461-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3461-1 advisory. - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. -...

CVE-2026-69088

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

EUVD-2026-52284

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

Security update for perl-DBI

This update for perl-DBI fixes the following issues: CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process...

CVE-2025-15673

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server...

gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a...

CVE-2026-14682

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X serie...