CVE-2026-19546 Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546...

EUVD-2026-56147

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities in bootstrap-3.4.1.tgz client library

Summary Vulnerabilities have been identified in bootstrap-3.4.1.tgz , which is used in IBM Engineering Lifecycle Management -Engineering Workflow Management Vulnerability Details CVEID:CVE-2024-6484 DESCRIPTION: Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript i...

RLSA-2026:52772 Important: perl-DBI:1.641 security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: DBI: Heap overflow when...

perl-DBI:1.641 security update

An update is available for perl-DBI, module.perl-DBI. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The perl-DBI package provides the standard database interfa...

RockyLinux 8 : perl-DBI:1.641 (RLSA-2026:52772)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:52772 advisory. DBI: Heap overflow when preparsing SQL statements with excessive placeholders CVE-2026-14739 DBI: Arbitrary code execution via caller-influenced Profile...

Important: isns-utils security update

The iSNS package contains the daemon and tools to setup a iSNS server, and iSNS client tools. The Internet Storage Name Service iSNS protocol allows automated discovery, management and configuration of iSCSI and Fibre Channel devices using iFCP gateways on a TCP/IP network. Security Fixes:...

CVE-2026-65655: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

RHEL 10 : isns-utils (RHSA-2026:53846)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53846 advisory. The iSNS package contains the daemon and tools to setup a iSNS server, and iSNS client tools. The Internet Storage Name Service iSNS protocol allow...

ALSA-2026:53846 Important: isns-utils security update

The iSNS package contains the daemon and tools to setup a iSNS server, and iSNS client tools. The Internet Storage Name Service iSNS protocol allows automated discovery, management and configuration of iSCSI and Fibre Channel devices using iFCP gateways on a TCP/IP network. Security Fixes:...

CVE-2026-72720

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...

CVE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...

CVE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...

CVE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...

CVE-2026-72720

CVE-2026-72720 affects the Discourse open‑source forum platform. The issue is an HTML injection vulnerability in PrettyText.format_for_email where cooked attribute values are reparsed as markup, enabling decoded attribute text from crafted Vimeo iframe sources, secure-upload URLs or dimensions, a...

CVE-2026-68235

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: dce100: skip non-DP stream encoders for DP MST On DCE8-class ASICs e.g. Bonaire, the resource pool contains digital DIG stream encoders plus one analog DAC encoder. When assigning a stream encoder for a second...

EUVD-2026-55389

In the Linux kernel, the following vulnerability has been resolved: net: dropmonitor: fix info leak in NETDMATTRPAYLOAD netdmpacketreportfill and netdmhwpacketreportfill open code the NETDMATTRPAYLOAD attribute to avoid zeroing the packet payload before overwriting it with skbcopybits. skbput...

CVE-2026-68288 net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD

In the Linux kernel, the following vulnerability has been resolved: net: dropmonitor: fix info leak in NETDMATTRPAYLOAD netdmpacketreportfill and netdmhwpacketreportfill open code the NETDMATTRPAYLOAD attribute to avoid zeroing the packet payload before overwriting it with skbcopybits. skbput...

CVE-2026-68235

The CVE refers to drm/amd/display (dce100) in the Linux kernel. Root cause: when assigning a stream encoder for a second DisplayPort MST stream on DCE8-class ASICs, if the preferred digital encoder is already acquired, the code can fall back to an analog DAC encoder whose funcs table lacks DP hoo...

CVE-2026-68235 drm/amd/display: dce100: skip non-DP stream encoders for DP MST

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: dce100: skip non-DP stream encoders for DP MST On DCE8-class ASICs e.g. Bonaire, the resource pool contains digital DIG stream encoders plus one analog DAC encoder. When assigning a stream encoder for a second...