CVE-2026-49394 Frappe: Auth. bypass via update_page

Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the updatepage endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0...

CVE-2026-57221

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and...

CVE-2026-57575 Misskey: SSRF bypass in URL Preview

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery SSRF vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can...

CVE-2026-55405

LangChain4j contains a SQL injection vulnerability in the embedding stores for MariaDB and pgvector. Prior to versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, metadata filter keys (and, for MariaDB, some string values) are concatenated directly into SQL in EmbeddingSearchRequ...

CVE-2026-55843

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse...

gstreamer1-plugins-bad-free security update

An update is available for gstreamer1-plugins-bad-free. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs ...

CVE-2026-53363

CVE-2026-53363 (Linux kernel xfrm/iptfs): The vulnerability arises because iptfs_consume_frags() does not propagate the SKBFL_SHARED_FRAG flag when transferring paged fragments, mirroring the flaw fixed in skb_try_coalesce() for CVE-2026-46300. As a result, ESP could make incorrect in-place encry...

ROOT-APP-NPM-CVE-2026-48022 CVE-2026-48022 in @rootio/hapi__wreck - Patched by Root

Root has patched CVE-2026-48022 in the @rootio/hapiwreck package for Root:npm. Multiple fixed versions available...

OPENSUSE-SU-2026:21310-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: - Update to version 2.96.0: Critical security fix: patched vulnerability in gh codespace jupyter that could allow command execution when connecting to malicious Codespaces Merge commit from fork Fix concurrent map writes in codespace...

[slackware-security] tigervnc

New tigervnc packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/tigervnc/tigervnc-1.16.2-i586-4slack15.0.txz: Rebuilt. Recompiled against xorg-server-1.20.14, including patches for security issues: glamor Fo...

PT-2026-57301

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 Description Authentication for AMQP 0-9-1, AMQP 1.0, and Stream Protocol allows a loopback-restricted user,...

freerdp security update

2:2.11.7-7.4 - Fix incorrect bounds checks in planar codec CVE-2026-45700 Resolves: RHEL-186991...

OPENSUSE-SU-2026:11250-1 qemu-11.0.2-1.1 on GA media

These are all security issues fixed in the qemu-11.0.2-1.1 package on the GA media of openSUSE Tumbleweed...

Virtuozzo Infrastructure 7.3 Update 1 Hotfix 2 (7.3.1-62)

This update provides a security fix. Vulnerability id: VSTOR-137528 A security fix for CVE-2026-53359...

DEBIAN-CVE-2026-59831

GitHub CLI gh is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopbac...

CVE-2026-59854

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts attacker-supplied absolute source paths and relies on util.IsSensitivePath in kernel/util/path.go, whose denylist misses common home-directory credential files such as...

CVE-2026-59828

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users could be leaked through visible diffs on adjacent revisions serialized by PostRevisionSerializer. This issue is fixed in versions 2026.6.0,...

CVE-2026-59828

CVE-2026-59828 affects the Discourse open‑source discussion platform. Before versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users could be leaked through visible diffs on adjacent revisions serialized by PostRevisionSerializer. This could di...

CVE-2026-55424

CVE-2026-55424 – Discourse topic featured link stored XSS . Discourse (open-source discussion platform) prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 allowed a mis-normalized/undescoped topic feature link to inject JavaScript when default Content Security Policy protections were mo...

CVE-2026-49256 Discourse: Hidden tag names leaked via category serializers

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowedtags, allowedtaggroups, or required tag groups could leak to anonymous and unauthorized users through categor...