Astra Linux – Vulnerability in Python 3.11

The poplib module, when a user-controlled command is passed to it, can have additional commands injected using newlines. Mitigation rejects commands that contain control characters...

Astra Linux – Vulnerability in Python 3.11

The email module, specifically the “BytesGenerator” class, did not properly quote newlines for email headers when serializing an email message. This issue occurs only when using “LiteralHeader” to write headers that do not follow email folding rules. The new behavior will reject incorrectly folde...

Astra Linux – Vulnerability in Python 3.11

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL’s media type...

Astra Linux – Vulnerability in Python 3.11

When using http.cookies.Morsel, user-controlled cookie values and parameters may allow the injection of HTTP headers into messages. The patch rejects all control characters within cookie names, values, and parameters...

CLSA-2026-1784683091 TuxCare security update for immutable (1 CVE)

TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.3.7-tuxcare.2...

CVE-2026-69085

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint. The caller-supplied keyword is concatenated into SQL without escaping or parameter binding, and the statement can execute on a read-write SQLite handle via a driver that supports stacked statemen...

GHSA-7QF5-7PPR-87V8 Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references. Original Description Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX...

Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references. Original Description Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX...

SUSE CVE-2026-54158

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view database cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like or " breaks out of its surrounding tag and runs arbitrary...

CLEANSTART-2026-RB15576 Security fixes in kyverno-policy-reporter-fips 3.7.3-r1

Package kyverno-policy-reporter-fips version 3.7.3-r1 fixes 3 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-39883...

CLEANSTART-2026-ZU41550 Security fixes in elastic-beats 9.3.7-r0

Package elastic-beats version 9.3.7-r0 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-KC30939 Security fixes in argo-workflows-fips 3.7.8-r2

Package argo-workflows-fips version 3.7.8-r2 fixes 7 vulnerabilities: ghsa-fw7p-63qq-7hpr, ghsa-q9hv-hpm4-hj6x, ghsa-9h8m-3fm2-qjrq, CVE-2026-26958, CVE-2026-1229...

CLEANSTART-2026-CJ46936 Security fixes in kyverno-policy-reporter-fips 3.7.2-r0

Package kyverno-policy-reporter-fips version 3.7.2-r0 fixes 2 vulnerabilities: CVE-2026-26958, ghsa-fw7p-63qq-7hpr...

CLEANSTART-2026-JK70827 Security fixes in elasticsearch 9.3.7-r1

Package elasticsearch version 9.3.7-r1 fixes 5 vulnerabilities: CVE-2026-54399, CVE-2026-54428, CVE-2026-41715, CVE-2026-42579, CVE-2026-45536...

MINI-6X33-7PG4-G72J

Bulletin has no description...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: loki3.7: loki3.7-3.7.4-0.1.hum1 aarch64, x8664 loki3.7-canary-3.7.4-0.1.hum1 aarch64, x8664 loki3.7-logcli-3.7.4-0.1.hum1 aarch64, x8664 loki3.7-3.7.4-0.1.hum1.src src...

CVE-2026-65058 Trezor Safe improper security check in on-device display

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum signtx / signtxeip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata...

CVE-2026-57771

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through = 3.7...

[SECURITY] Fedora 44 Update: tmux-3.7b-2.fc44

tmux is a "terminal multiplexer." It enables a number of terminals or windows to be accessed and controlled from a single terminal. tmux is intended to be a simple, modern, BSD-licensed alternative to programs such as GNU Screen...

EUVD-2026-42803

The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkpproduct' shortcode in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. Th...