CVE-2026-84837 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

Security update for bzip2

This update for bzip2 fixes the following issue: CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash bsc1266786. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupda...

Security update for texlive

This update for texlive fixes the following issue: CVE-2026-63729: heap use-after-free in the SyncTeX parser can lead to application crash or arbitrary code execution when malformed .synctex or .synctex.gz files are processedbsc1272432. Patch Instructions: To install this SUSE update use the SUSE...

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object... WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key expr is evaluated when zod.object...

GHSA-6MR6-JVCR-2F25 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object... WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key expr is evaluated when zod.object...

kubescape v4.0.13

Kubescape Comprehensive Kubernetes Security from Development to Runtime Kubescape is an open-source Kubernetes security platform that pr...

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

Impact The filer registered the IAM gRPC service SeaweedIdentityAccessManagement with no authentication. Any client able to reach the filer gRPC port could invoke IAM RPCs — CreateUser, CreateAccessKey, PutUserPolicy, and related calls — to mint credentials and grant itself S3 administrative...

GHSA-2V6V-25FM-P4FG SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

Impact The filer registered the IAM gRPC service SeaweedIdentityAccessManagement with no authentication. Any client able to reach the filer gRPC port could invoke IAM RPCs — CreateUser, CreateAccessKey, PutUserPolicy, and related calls — to mint credentials and grant itself S3 administrative...

GHSA-FJ2P-QJ2F-74V5 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Summary An account with the admin.pages permission or api.pages.write can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page. Details Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php:426 passes a...

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Summary An account with the admin.pages permission or api.pages.write can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page. Details Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php:426 passes a...

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...

GHSA-9HJF-W35W-6VX2 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-570_116_1, kpatch-patch-5_14_0-570_17_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-687_10_1 security update

An update for kpatch-patch-5140-687101 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_125_1, kpatch-patch-4_18_0-553_53_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...