Important: Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

The latest release of Red Hat Update Infrastructure. For more details, see the product documentation. Red Hat Update Infrastructure RHUI container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version...

389-ds-base security, bug fix, and enhancement update

An update is available for 389-ds-base. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The...

RLSA-2026:64784 Critical: 389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length...

389-ds-base security, bug fix, and enhancement update

An update is available for 389-ds-base. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The ba...

389-ds:1.4 security, bug fix, and enhancement update

An update is available for module.389-ds-base, 389-ds-base. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list 389 Directory Server is an LDAP version 3 LDAPv3...

PT-2026-89175

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An issue exists in the knowledge base delete handler where a non-administrator user with write access to an external knowledge base can delete the shared instance configuration. This occurs...

CVE-2026-87998: Improper Privilege Management

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/id/delete in backend/openwebui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection...

RockyLinux 9 : 389-ds-base (RLSA-2026:64784)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64784 advisory. 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasliostartpacket CVE-2026-18355 389-ds-base:...

Kibana 8.19.11 < 8.19.21 / 9.3.x < 9.4.6 / 9.5.x < 9.5.2 Incorrect Authorization (ESA-2026-142)

The version of Kibana installed on the remote host is 8.19.11 prior to 8.19.21, or 9.3.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-142 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to unauthorized...

RockyLinux 10 : 389-ds-base (RLSA-2026:64785)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64785 advisory. 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasliostartpacket CVE-2026-18355 389-ds-base:...

ROS-20260909-73-0039

The vulnerability of the Base component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

CVE-2026-87060

A flaw was found in olm-operator-konflux-sample. The system's automated merging of updates, known as Renovate automerge, is configured too broadly, allowing a wide range of updates without sufficient scrutiny. Additionally, the critical base image for the catalog, ose-operator-registry, is entire...

CVE-2026-87055

A flaw was found in operator-sdk-builder. The software uses a flexible label, called a mutable tag, to identify its base container image instead of a unique, fixed identifier. This practice allows the underlying base image to change unexpectedly between builds. Such a change could introduce...

NPM: Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

NPM: Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base vulnerability discovered by ? in WordPress Npm astro versions = 7.2.3...

EUVD-2026-70213

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base...

GHSA-376H-93R7-7G6F Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Summary Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observe...

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Summary Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observe...

389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

Base Function Poisoning

Spring Cloud Function is vulnerable to base function poisoning. The vulnerability is due to improper handling of function composition lookup, which allows an attacker to manipulate or poison the base function and potentially execute unintended function compositions...

389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of...