[SECURITY] Fedora 45 Update: wf-config-0.10.0-4.fc45

Library for managing configuration files, written for wayfire...

CVE-2026-101104 Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...

CVE-2026-10026

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to and including 7.6.12 . The root cause is insufficient input validation on the 'Feed Config' field, which is passed directly to the eval() function. This allows authenticated attackers with Administrator-le...

CVE-2026-10026 CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...

Spring Cloud Config Server - Local File Inclusion

Spring Cloud Config Server versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafte...

CVE-2026-10026: Improper Control of Generation of Code

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...

PT-2026-104075

Name of the Vulnerable Software and Affected Versions CTX Feed Pro versions prior to 7.6.13 Description Insufficient input validation on the 'Feed Config' field allows authenticated attackers with Administrator-level access and above to execute arbitrary PHP code on the server. This occurs becaus...

ROOT-APP-MAVEN-CVE-2026-22739 CVE-2026-22739 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-22739 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41002 CVE-2026-41002 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-41002 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40981 CVE-2026-40981 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-40981 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40982 CVE-2026-40982 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-40982 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2024-UG97969 Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90

Security vulnerability affects the chromium package. Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90...

Rocky Linux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (ALMALINUX9.6:CLSA-2026:1778269628)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778269628 advisory. - A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory...

Rocky Linux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1764696522)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1764696522 advisory. - A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible...

CentOS Linux 8.4 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (CENTOS8.4:CLSA-2026:1776701249)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1776701249 advisory. - A flaw was found in libssh in which a malicious SFTP SSH File Transfer Protocol server can exploit this by sending a malformed 'longname'...

Rocky Linux 8 [CIQ] Security Update: dhcp-client / dhcp-client-debuginfo / dhcp-common / dhcp-debuginfo / etc (crlsa-2021_2359)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212359 advisory. dhcp: stack-based buffer overflow when parsing statements with colon-separated hex digits in config or lease files in dhcpd and dhclient CVE-2021-25217 Tenable has...

AlmaLinux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786549709)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786549709 advisory. - A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing lat...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2026:1775040432)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1775040432 advisory. - Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content...

AlmaLinux 9.2 [TuxCare] Security Update: freeipmi / freeipmi-bmc-watchdog / freeipmi-devel / etc (ALMALINUX9.2:CLSA-2026:1785840756)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785840756 advisory. - ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface IPM...

AlmaLinux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1765985737)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1765985737 advisory. - A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting...