RHEL 10 : httpd (RHSA-2026:47046)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47046 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

OPENSUSE-SU-2026:11389-1 kubernetes1.34-apiserver-1.34.10-1.1 on GA media

These are all security issues fixed in the kubernetes1.34-apiserver-1.34.10-1.1 package on the GA media of openSUSE Tumbleweed...

TencentOS Server 3: python3.12 (TSSA-2026:0768)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0768 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2026-65442

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

CVE-2026-61953

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

Updated x11-server x11-server-xwayland tigervnc packages fix security vulnerabilities

The updated packages fix security vulnerabilities: glamor Font Atlas Heap Buffer Overflow. CVE-2026-55999 GLX contextTags Use-After-Free in CommonMakeCurrent. CVE-2026-56000...

CVE-2026-65442 WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

CVE-2026-65442

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

CVE-2026-65442

The CVE-2026-65442 entry concerns the WordPress FormCraft plugin up to version 3.9.15 with an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. Documentation from multiple sources confirms the affected product (FormCraft) and the vulnerability class (SSRF) but does not provide roo...

CVE-2026-61953 WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-61953

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-61953

CVE-2026-61953 affects the WordPress plugin Simple Link Directory Pro

CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

EUVD-2026-49634

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-55685 React Router: Unauthenticated Denial of Service via Inefficient Route Matching

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-59728

Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Bot...

CVE-2026-39873

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Connecting to a malicious SMB server may lead to unexpected system termination...

CVE-2026-53666 React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...