Important: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Critical: webkit2gtk3 security, bug fix, and enhancement update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read CVE-2026-87596 chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafte...

CVE-2024-4457

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enabl...

EUVD-2024-55805

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enabl...

Google Agent Mesh Authorization Vulnerability

The Google Agent Mesh version 0.1.0-alpha.1 to 0.1.0-alpha.2 contains an authorization vulnerability. This vulnerability stems from the lack of key functionality for authentication and authorization in the/libp2p-http entry server. Biscuit tokens or grid registrations are not verified, resulting ...

IBM MQ Operator deserialization injection vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0 through 3.8.1, 3.9.0 through 3.9.2, and 4.0.0 through 4.0.4 have a deserialization injection...

GeoVision GV-ASManager command injection vulnerability

The GeoVision GV-ASManager 6.3.0 version has a command injection vulnerability. This vulnerability stems from the default web server connection port of the GeoWebServer.exe process, which allows for OS command injection, potentially enabling the execution of arbitrary commands...

WSO2 Enterprise Integrator code injection vulnerability

The WSO2 Enterprise Integrator version 6.6.0 up to 6.6.0.205 contained a code injection vulnerability. This vulnerability stemmed from insufficient data validation for user-provided data, allowing malicious Expression Language EL code to be injected. Attackers with administrative privileges could...

IBM Cloud Pak System Cross-site Scripting Vulnerability

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 have a cross-site scripting vulnerability. This vulnerability stems from cross-site scripting issues, which may allow users to embed arbitrary JavaScript code in the Web UI, altering intended functions and leading to the exposure of credentials in...

PT Norther Lights Production Map – SVG file upload vulnerability

PT Norther Lights Production Map: Versions prior to SVG 8.16.1 have an arbitrary file upload vulnerability. This vulnerability stems from allowing the upload of dangerous types of files, which may lead to the uploading of a Web Shell to the web server...

GIMP resource management error vulnerabilities

GIMP has a resource management vulnerability. This vulnerability arises because the XCF loader may leave empty pointers in the link channel list after the link channel’s properties are destroyed by the selection attribute. Opening a specially crafted XCF file can cause the GIMP main process to...

Red Hat Enterprise Linux Resource Management Vulnerability

Red Hat Enterprise Linux has a resource management vulnerability. This vulnerability arises when GIMP attempts to load a specially crafted XCF file by selecting a path; the loading process fails. As a result, the main process is reloaded after being released, potentially leading to a crash and...

Pillow buffer error vulnerability

Versions of Pillow prior to 13.0.0 have a buffer error vulnerability. This vulnerability arises from the FlashPix JPEG-tile decoder, which, when processing specially crafted OLE2 FlashPix files, fails to recognize the JPEG mode and instead decodes it as a four-component JCSUNKNOWN. As a result,...

Purocean Yank Note: Path traversal vulnerability

Purocean Yank Note versions prior to 3.93.1 have a path traversal vulnerability. This vulnerability stems from issues with the path or doc parameters in the/api/help endpoint. Attackers can exploit this by providing repeated “../” segments, thereby bypassing single replacement cleanup. As a resul...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a buffer error...

Red Hat Enterprise Linux Input Validation Vulnerability

Red Hat Enterprise Linux versions 8, 9, and 10, as well as Red Hat Hardened Images version 1, have a vulnerability in input validation. This vulnerability arises from bootc, under the default container signature policy, automatically or manually upgrading variable image tags that fall under...

Viraj Potdar Criminal-Management-System: Vulnerabilities in Permission Authorization and Access Control Mechanisms

The Viraj Potdar criminal-management-system has a security vulnerability. This vulnerability stems from improper handling of the parameter ‘myimg’ in the ‘move Uploaded File’ function within the ‘home.php’ file. As a result, arbitrary file uploads can occur, and this vulnerability may be exploite...

Dell Application Store Authorization Issues Vulnerability

Versions of the Dell Application Store prior to 26.05.0.7 have a vulnerability related to authorization. This vulnerability stems from the lack of authentication for critical functions, allowing attackers with unauthenticated access and network access rights to execute arbitrary code...

Progressive Robot hMailServer authorization issue vulnerability

The Progressive Robot hMailServer versions from 6.2.22 to 6.3.6, as well as from 6.0.0 to 6.3.6, have an authorization vulnerability. This vulnerability stems from the lack of authorization for Sieve notification actions and email rule responses. The server does not verify whether the sender...

Eptura Archibus arbitrary file upload vulnerability

Versions of Eptura Archibus prior to 2025.02 contained a vulnerability related to arbitrary file upload. This vulnerability stemmed from the ability of users to upload exported reports containing arbitrary file content, specify arbitrary content, and upload JSP code with JSPX as the file extensio...