Important: Red Hat Security Advisory: bind security, bug fix, and enhancement update

An update for bind is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2026-123841: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive...

CVE-2026-92895: jiangweifang Live2DWebCanvas: The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…

The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the downloadonefile function. This is due to missing file extension whitelist and MIME type validation in downloadonefile when writing files derived from...

CVE-2026-123835: JetBrains Datalore: In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload…

In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition...

CVE-2026-123783: Skyvern-AI skyvern: Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by…

Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the issafescriptcode AST denylist and import blocked modules such as subprocess...

CVE-2026-123849: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File…

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers...

UBUNTU-CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

UBUNTU-CVE-2026-122329

SDLmixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw in src/decoderaiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing...

RockyLinux 9 : tesseract (RLSA-2026:95086)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:95086 advisory. tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data CVE-2026-88048 tesseract: Tesseract: Stack buffer...

RHEL 8 : xorg-x11-server-Xwayland (RHSA-2026:95281)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:95281 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: arbitrary code execution via...

Rocky Linux 10.2 [CIQ] Security Update: tesseract / tesseract-debuginfo / tesseract-debugsource / etc Multiple Vulnerabilities (crlsa-2026_95085)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202695085 advisory. tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data CVE-2026-88048 tesseract: Tesseract: Stack buffe...

CVE-2026-123278: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint...

CVE-2026-123854: JetBrains PyCharm: In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module...

CVE-2026-80302: Gen Digital: Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged…

Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside the sandbox to write arbitrary files outside sandbox containment and execute code on the host. The sandbox virtualizes file system operations by intercepting...

CVE-2026-123852: JetBrains Junie GitHub Action: In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates

In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates...

CVE-2026-123321: JetBrains WebStorm: In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted…

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects...

UBUNTU-CVE-2026-121994

A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetchregisterusingp, which decodes a stub's register reply into an alloca-sized buffer without bounding writes b...

CVE-2026-104010: creativewerkdesigns WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database: The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable…

The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field e.g., your-message' parameter parameter. This is due to insufficient...

CVE-2026-123832: JetBrains CLion: In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database...

CVE-2026-123304: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path...