Vulnerability in libxml2 (CVE-2025-8732) affects AIX

IBM SECURITY ADVISORY First Issued: Wed Feb 18 08:44:14 CST 2026 |Updated: Fri Mar 13 13:55:04 CDT 2026 |Update: Added iFix information for VIOS 3.1. The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/libxml2advisory10.asc Security Bulleti...

Important: Red Hat Security Advisory: nodejs22 security update

An update for nodejs22 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

CVE-2026-2296 Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 3.1.0. This is due to insufficient input validation of the 'operator' field in conditional logic rules within the evalConditions...

[SECURITY] Fedora 43 Update: vim-9.1.2146-1.fc43

VIM VIsual editor iMproved is an updated and improved version of the vi editor. Vi was the first real screen-based editor for UNIX, and is still very popular. VIM improves on vi by adding new features: multiple windows, multi-level undo, block highlighting and more...

[SECURITY] Fedora 43 Update: mingw-libpng-1.6.55-1.fc43

MinGW Windows Libpng library...

[SECURITY] Fedora 43 Update: mingw-python3-3.11.14-7.fc43

MinGW Windows python3...

[SECURITY] Fedora 42 Update: freerdp-3.22.0-1.fc42

The xfreerdp & wlfreerdp Remote Desktop Protocol RDP clients from the FreeR DP project. xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows machines, xrdp and VirtualBox...

WordPress YayMail plugin <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint vulnerability

Missing Authorization to Authenticated Shop Manager+ License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint vulnerability discovered by whizzu in WordPress Plugin YayMail – WooCommerce Email Customizer versions = 4.3.2...

PT-2026-20375

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cmplz-accept-link shortcode in all versions up to, and including, 7.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

libxml2-16-2.14.5-4.1 on GA media (moderate)

libxml2-16-2.14.5-4.1 on GA media Announcement ID: openSUSE-SU-2026:10213-1 Rating: moderate Cross-References: CVE-2025-8732 CVE-2026-0990 CVE-2026-0992 CVSS scores: CVE-2025-8732 SUSE : 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-8732 SUSE : 4.8...

PT-2026-20485

A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be...

PT-2026-20294

The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the /yaymail-license/v1/license/delete REST endpoint in versions up to, and including, 4.3.2. This makes it possible for authenticated...

Medium: python3.13

Issue Overview: When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized. CVE-2025-11468 User-controlled...

The vulnerability of the 3D model texturing program Adobe Substance 3D Designer, related to pointer assignment errors, allows a hacker to cause a service failure.

The vulnerability of the 3D model texturing program Adobe Substance 3D Designer is related to pointer assignment errors. Exploiting this vulnerability can allow an attacker to cause a service failure, provided that the user opens a specially crafted file...

The vulnerability of the Substance 3D Stager software lies in its inability to handle buffer overflow attacks, allowing attackers to execute arbitrary code.

The vulnerability of the Substance 3D Stager software lies in its susceptibility to execution outside the buffer boundaries. Exploiting this vulnerability allows an attacker to execute arbitrary code, provided that the user opens a specially crafted file...

The vulnerability of the Substance 3D Stager software lies in its ability to read data beyond the acceptable range of memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Substance 3D Stager software-related 3D design software is related to reading beyond the allowable range of memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

Fedora 42 : mingw-python3 (2026-c8b3418f91)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c8b3418f91 advisory. Backport fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299 Tenable has extracted the preceding description block...

Fedora 43 : mingw-libsoup (2026-44af0f2383)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-44af0f2383 advisory. Backport fixes for CVE-2026-0716, CVE-2026-0719. Tenable has extracted the preceding description block directly from the Fedora security advisory...

PT-2026-20560

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel...

Fedora: Security Advisory (FEDORA-2026-7eda235f65)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...