CLSA-2026-1786636721 TuxCare security update for dompurify (14 CVEs)

TuxCare rebuilt dompurify to address 14 CVEs. Fixed in 2.4.7-tuxcare.1...

CLSA-2026-1786636613 TuxCare security update for dompurify (11 CVEs)

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 2.4.3-tuxcare.1...

UBUNTU-CVE-2026-70462

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-6387

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges...

DEBIAN-CVE-2026-53801

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...

UBUNTU-CVE-2026-70458

rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINKBUMP processing on file entries with the FLAGHLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing FSUM field in the...

UBUNTU-CVE-2026-53785

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...

UBUNTU-CVE-2026-70454

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

Philips Hue Bridge Pro

RISK EVALUATION The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker v2.0.22 that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and control connected lights...

CVE-2026-6387

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-6387

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-6387

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-6387

Technical details for CVE-2026-6387 are not publicly available in the provided documents. Monitor Lenovo notices and NVD for updates on affected products, impacted components, root cause, and remediation.

EUVD-2026-58055

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges...

OESA-2026-3401 buildah security update

The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...

DEBIAN-CVE-2026-14673

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

MINI-JFQ9-57HV-V7GF

Bulletin has no description...

Critical: Red Hat Security Advisory: Multicluster Global Hub 1.5.7 security update

Multicluster Global Hub v1.5.7 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a...

CLSA-2026-1786623881 TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 9 CVEs. Fixed in 6.0.16-tuxcare.5...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.13: python3.13-3.13.15-1.hum1 aarch64, x8664 python3.13-debug-3.13.15-1.hum1 aarch64, x8664 python3.13-devel-3.13.15-1.hum1 aarch64, x8664 python3.13-freethreading-3.13.15-1.hum1 aarch64,...