Security update for wget

This update for wget fixes the following issues: CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. CVE-2026-58470:...

PT-2026-62102

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling. This leads to remote code execution as a...

PT-2026-62044

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx find locked. The attach-time validator rdx validate header checks the header scalars and region layout against the file size, but does not validate the node records it...

PT-2026-62053

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph walk cell and sph alloc slot. The attach-time validator sph validate header checks the header scalars and region layout against the file size, but...

PT-2026-62051

Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem size in ring read seq. The attach-time validator ring validate header checks the capacity-overflow and total size consistency of the header but never caps elem size against the destination...

CVE-2026-56452 Apache MINA SSHD: Path traversal in SCP file reception

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...

CVE-2026-44583 Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

MGASA-2026-0280 Updated nilfs-utils packages fix security vulnerability

Undefined Behavior and Out-of-Memory via Unvalidated slogblocksize. CVE-2026-55392...

Updated nilfs-utils packages fix security vulnerability

Undefined Behavior and Out-of-Memory via Unvalidated slogblocksize. CVE-2026-55392...

CVE-2026-63102

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-63428

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, completeSubmission accepts a hiddenFields: id, name, value array from the submitter and stores it verbatim in submission.hiddenFields, without validating the supplied id/name against the form's declared form.hiddenFields schema...

CVE-2026-63428 HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, completeSubmission accepts a hiddenFields: id, name, value array from the submitter and stores it verbatim in submission.hiddenFields, without validating the supplied id/name against the form's declared form.hiddenFields schema...

EUVD-2026-45979

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-63102

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-63102 rConfig Core < 8.2.8 Privilege Escalation via Users API role field

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-45139

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist 'css','js','html','txt','json','sql','md' on content-write operations saveFile, createFile, but two destructive endpoints — deleteFileOrFolder and...

CVE-2026-45139 CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist 'css','js','html','txt','json','sql','md' on content-write operations saveFile, createFile, but two destructive endpoints — deleteFileOrFolder and...

EUVD-2026-45945

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

EUVD-2026-45915

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to...

CVE-2026-63744

SurrealDB prior to 3.1.5 contains a server-side request forgery in the JWKS fetcher that follows HTTP redirects without re-validating targets against network capabilities. With Owner privileges, an attacker can configure a JWKS URL that redirects to blocked internal addresses, bypassing network a...