Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-19994

A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management/execute of the component Configuration Management. The manipulation of the argument action results in authorization bypass. The attack ma...

CVE-2026-19994 Webkul Bagisto Configuration Management execute authorization

A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management/execute of the component Configuration Management. The manipulation of the argument action results in authorization bypass. The attack ma...

EUVD-2026-60059

A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management/execute of the component Configuration Management. The manipulation of the argument action results in authorization bypass. The attack ma...

BIT-JENKINS-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

EUVD-2026-60047

A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...

CVE-2026-19984 jkawamoto mcp-florence2 __init__.py get_images server-side request forgery

A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...

389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

K000162943: Spring boot vulnerability CVE-2026-40992

Security Advisory Description Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through...

EUVD-2026-60448

An issue in OSSRS SRS Simple Realtime Server v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration security.enabled, SrsSecurity::check, trunk/src/app/srsappsecurity.cpp, and SRS RTMP listener components...

PT-2026-73346

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

VulnCheck KEV: CVE-2026-8452

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway SSL VPN, ICA Proxy, CVPN, RDP Proxy or AAA virtual server...

CVE-2024-58375

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

EUVD-2024-55722

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

CVE-2024-58375

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

CVE-2024-58375

OpenTofu 1.8.0–1.8.2 do not properly restrict sensitive variables/locals when static evaluation is enabled, allowing potential leakage of values marked as sensitive through configuration elements. The issue is resolved in OpenTofu 1.8.3, which adds explicit errors to prevent use of sensitive valu...

CVE-2026-15345

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 has a broken access control flaw: any user with the Contributor role or above can retrieve every chart's full configuration in a single request, potentially exposing remote data source credentials stored in chart settings. CVSS 3.1 scores this MEDIUM (...