ALSA-2026:67155 Moderate: perl security update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 For more details about the security issues, including the impac...

PT-2026-91411

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

CVE-2023-37366

CVE-2023-37366 is a remote denial-of-service vulnerability in Samsung Exynos mobile, automotive, and modem processors (including Exynos 9810 through 2200, Modem 5123/5300, and Auto T5123). The root cause is in cd_parseMsg (file cd_codec.c) within the Shannon SM Task, where improper input validati...

PT-2026-91690

A certificate validation issue was addressed with improved certificate validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to intercept network traffic...

CVE-2023-46035

CVE-2023-46035 affects the svg_optimizer Ruby gem (versions before 0.3.0 , specifically v0.2.6), an SVG optimization library based on Node's SVGO. The vulnerability is an XML External Entity (XXE) injection caused by allowing entity expansion by default when parsing untrusted SVG documents. A rem...

ROS-20260914-73-0095

The vulnerability of the Password component in Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through a specially created HTML page...

CVE-2023-50462

The Content Consent (content_consent) extension for TYPO3 , versions through 2.0.1 , suffers from an Insecure Direct Object Reference (IDOR) . The plugin fails to verify whether a specified content element identifier is permitted, allowing an unauthenticated user to display various content elemen...

PT-2026-91650

A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Apple Intelligence security prompts...

rust security update

1.92.0-2 - Apply libgit2 fix for CVE-2026-53587...

python-tornado security update

6.5.8-0.1 - Update to 6.5.8 Resolves: RHEL-247266...

PT-2026-91210

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

About the security content of iOS 26.7 and iPadOS 26.7

About the security content of iOS 26.7 and iPadOS 26.7 This document describes the security content of iOS 26.7 and iPadOS 26.7. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

ROS-20260914-73-0090

The vulnerability of the Network component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

The vulnerability of the Windows Cloud Files Mini Filter Driver for operating systems allows attackers to bypass existing security mechanisms and compromise the integrity of protected information.

The vulnerability of the Windows Cloud Files Mini Filter Driver for operating systems affects the lack of authentication for a critical function. Exploiting this vulnerability can allow attackers to bypass existing security mechanisms and compromise the integrity of the protected information...

The vulnerability of the Enterprise Infrastructure Security component of the JD Edwards EnterpriseOne Tools system allows a perpetrator to gain unauthorized access to read, create, modify, and delete protected information.

The vulnerability of the Enterprise Infrastructure Security component of the JD Edwards EnterpriseOne Tools system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to read, create, modify, and dele...

OPENSUSE-SU-2026:11771-1 gimp-3.2.6-1.1 on GA media

These are all security issues fixed in the gimp-3.2.6-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2023-32803

The ca-certificates package on Amazon Linux 2 , Amazon Linux 2023 , and Amazon Linux AMI failed to properly remove certain TrustCor root certificates from the trust store. The flaw stems from an incorrect initial fix for CVE-2022-23491 . A remote attacker could potentially leverage the unremoved ...

ALSA-2026:67314 Important: nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

CVE-2023-50459

CVE-2023-50459 affects the in2code/femanager extension for TYPO3 (versions 7.x before 7.2.3 ). The root cause is broken access control in the edit user component, which fails to verify permissions. An authenticated frontend user can exploit this to edit data or delete accounts of various other fr...

PT-2026-91197

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...