Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101176)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101176 advisory. Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

MINI-9PCP-GVJW-PRVP

Bulletin has no description...

MINI-W469-W4X5-VCC3

Bulletin has no description...

Allocation of Resources Without Limits or Throttling

Overview org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the handling of the localized-text cache. An...

MINI-V865-QRWW-8X5G

Bulletin has no description...

Vim: Heap Buffer Overflow in Text Property Handling

...

MINI-MGM2-WXRM-2RC8

Bulletin has no description...

CVE-2026-73635: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

SUSE CVE-2026-18024

Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.6, 17.11, 16.1...

MINI-PC34-HQW3-9PGX

Bulletin has no description...

MINI-8RQ9-4RHJ-PQ9V

Bulletin has no description...

MINI-744M-7VVG-6P25

Bulletin has no description...

MINI-QFCC-VJ2X-JXVP

Bulletin has no description...

MINI-FMG4-QWVG-7GW8

Bulletin has no description...

Exploit for Cross-site Scripting in Roundcube Webmail

CVE-2026-54433: Roundcube plain-text email stored XSS !Explo...

CVE-2026-73074

An integer overflow in Vim's propaddone function allows a local attacker to cause a denial of service or potentially execute arbitrary code by adding an excessive number of text properties to a single line. Mitigation Do not run untrusted Vim scripts or plugins that call propadd in an unbounded...

SUSE CVE-2026-73075

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popupmarkopacityzindex in src/popupwin.c can use a negative wwinrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for wpopuptopoff and causing an...

CVE-2026-63361: Improper Neutralization of Input During Web Page Generation

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-73660

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames insid...

CVE-2026-73428

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a with an empty data-trix-attachment="" value, causing...