Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002229)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002229 advisory. Buffer overflow in net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service memory corruption and...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002323)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002323 advisory. net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to...

ECHO-62F3-975A-45C7

Bulletin has no description...

CVE-2025-40977

Stored Cross-Site Scripting XSS vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’, using the ‘subject’ and ‘description’ parameters...

CVE-2025-40978

Stored Cross-Site Scripting XSS vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request to ‘/ticket/x/conversion’, using the ‘replydescription’ parameter...

CVE-2026-22196

GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries...

CVE-2025-14507

CVE-2025-14507 — EventPrime for WordPress suffers unauthenticated sensitive information exposure via the REST API in all versions up to and including 4.2.7.0. Unauthenticated attackers could exfiltrate booking data (user names, emails, ticket details, payment information, and order keys) when the...

openssl security update

1:1.1.1k-14 - Backport fix for Out-of-bounds read & write in RFC 3211 KEK Unwrap Fix CVE-2025-9230 Resolves: RHEL-128613 - Fix bug for ticketlifetimehint exceed issue Resolves: RHEL-119891 1:1.1.1k-13 - Backport fix SSLselectnext proto from OpenSSL 3.2 Fix CVE-2024-5535 Resolves: RHEL-45654...

CVE-2026-22200

The CVE-2026-22200 issue affects Enhancesoft osTicket 1.18.x before 1.18.3 and 1.17.x before 1.17.7, where the ticket PDF export path allows an arbitrary file read. A vulnerability arises when a ticket submission includes crafted rich-text HTML with PHP filter expressions, which are not adequatel...

CVE-2025-40977

Stored Cross-Site Scripting XSS vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’, using the ‘subject’ and ‘description’ parameters...

CVE-2025-40978 Multiple vulnerabilities in WorkDo products

Stored Cross-Site Scripting XSS vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request to ‘/ticket/x/conversion’, using the ‘replydescription’ parameter...

CVE-2025-40977 Multiple vulnerabilities in WorkDo products

Stored Cross-Site Scripting XSS vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’, using the ‘subject’ and ‘description’ parameters...

CVE-2025-40977

CVE-2025-40977 is a stored Cross-Site Scripting (XSS) vulnerability affecting WorkDo’s eCommerceGo SaaS. The issue stems from insufficient validation of user input in POST requests to /store-ticket, using the fields “subject” and “description.” Affects WorkDo eCommerceGo (exact affected versions ...

CVE-2025-40977 Multiple vulnerabilities in WorkDo products

Stored Cross-Site Scripting XSS vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’, using the ‘subject’ and ‘description’ parameters...

CVE-2025-40975

CVE-2025-40975 describes a stored Cross-Site Scripting (XSS) vulnerability in WorkDo’s HRMGo. The issue arises from insufficient validation of user input in the description parameter of a POST to /hrmgo/ticket/changereply, allowing injected scripts to be stored. Root cause: lack of proper input v...

PT-2026-1801

Name of the Vulnerable Software and Affected Versions WorkDo eCommerceGo SaaS affected versions not specified Description A stored Cross-Site Scripting XSS issue exists due to insufficient validation of user-supplied data. The issue involves sending a POST request to the ''/ticket/x/conversion''...

WorkDo HRM SaaS HR and Payroll Tool 跨站脚本漏洞

WorkDo HRM SaaS HR and Payroll Tool is a human resource management software from WorkDo, Inc. WorkDo HRM SaaS HR and Payroll Tool suffers from a cross-site scripting vulnerability that stems from insufficient validation of user input for the replydescription parameter when sending a POST request ...

WorkDo HRMGo 跨站脚本漏洞

WorkDo HRMGo is a human resource management platform from WorkDo Inc. in the United States. WorkDo HRMGo suffers from a cross-site scripting vulnerability that stems from insufficient validation of user input for the subject and description parameters when sending a POST request to /store-ticket,...

PT-2026-1800

Name of the Vulnerable Software and Affected Versions WorkDo eCommerceGo affected versions not specified Description A stored Cross-Site Scripting XSS issue exists due to insufficient validation of user-supplied data. The issue is triggered by sending a POST request to the /store-ticket API...

CVE-2026-22196

GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries...