OPENSUSE-SU-2026:21643-1 Security update for python-pip

This update for python-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed to arbitrary locations on disk bsc1273090...

PT-2026-81124

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

PT-2026-81996

Summary eml parser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML...

PT-2026-82023

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet...

AlmaLinux 8 : NetworkManager (ALSA-2026:58555)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:58555 advisory. NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend CVE-2026-10805 Tenable has extracted the preceding descripti...

awx: notification backends allow SSRF and credential leakage

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

awx: notification backends allow SSRF and credential leakage

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

NetworkManager security update

An update is available for NetworkManager. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list NetworkManager is a system network service that manages network device...

RLSA-2026:58555 Moderate: NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband WWAN, and PPPoE devices, as well as providing VPN integration with a varie...

NetworkManager security update

An update is available for NetworkManager. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list NetworkManager is a system network service that manages network device...

Moderate: Red Hat Security Advisory: NetworkManager security update

An update for NetworkManager is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

PT-2026-99568

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.16.1 Description The software fails to revalidate share access when restoring cached navigator state from a context hint UUID. This allows attackers who previously held valid share access to replay the cached hint...

PT-2026-80906

Name of the Vulnerable Software and Affected Versions AWX affected versions not specified Description A server-side request forgery SSRF issue exists in the webhook, Mattermost, Rocket.Chat, and Grafana notification backends. These backends use notification template URLs as direct HTTP request...

ALSA-2026:58555 Moderate: NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband WWAN, and PPPoE devices, as well as providing VPN integration with a varie...

RockyLinux 9 : NetworkManager (RLSA-2026:58572)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58572 advisory. NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend CVE-2026-10805 Tenable has extracted the preceding...

RockyLinux 8 : NetworkManager (RLSA-2026:58555)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58555 advisory. NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend CVE-2026-10805 Tenable has extracted the preceding...

Moderate: NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband WWAN, and PPPoE devices, as well as providing VPN integration with a varie...

PYSEC-2026-3731

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

CVE-2026-65915

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

CVE-2026-65915: Improper Access Control

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...