Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

openSUSE 16 Security Update : yq (openSUSE-SU-2026:21500-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21500-1 advisory. Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add...

CVE-2026-17346

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...

CVE-2026-17346 pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...

CVE-2026-17346

CVE-2026-17346 affects pgAdmin 4 (Index Statistics sink for all-indexes listing in 1.0 and Publications/Subscriptions sinks in 5.0 prior to 9.17). The issue arose after CVE-2026-12044 fix: templates for sixteen COMMENT ON / pgstattuple / pgstatindex were hardened with qtLiteral, but several sinks...

PT-2026-66771

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in test sql string literal lint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, an...

Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector uses yaml-1.10.2.tgz, idna-3.10-py3-none-any.whl, pyjwt-2.12.1-py3-none-any.whl, postcss-8.5.3.tgz, postcss-selector-parser-6.0.10.tgz which are vulnerable to CVE-2026-33532, CVE-2026-45409, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525,...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses yaml-2.6.1.tgz, log4j-api-2.24.3.jar, onnx-1.21.0-cp311-cp311-manylinux227x8664.manylinux228x8664.whl, spring-boot-autoconfigure-3.5.14.jar, spring-web-6.2.18.jar, dompurify-3.3.3.tgz, netty-codec-http-4.2.12.Final.jar, qs-6.14.2.tgz,...

EEF-CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Summary Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which...

PT-2026-65798

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:3203-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3203-1 advisory. - Security: re-vendor the bundled Go dependencies no upstream source changes; tarball rebuilt from v1.7.4 with updated go.mod/vendo...

SUSE-SU-2026:3203-1 Security update for kubevirt

This update for kubevirt fixes the following issues: - Security: re-vendor the bundled Go dependencies no upstream source changes; tarball rebuilt from v1.7.4 with updated go.mod/vendor: golang.org/x/net v0.48.0 - v0.55.0: CVE-2026-33814 bsc1265736, CVE-2026-39821 bsc1266575, CVE-2026-25680,...

Important: Red Hat Security Advisory: pki-deps:10.6 security update

An update for the pki-deps:10.6 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A...

RockyLinux 8 : pki-deps:10.6 (RLSA-2026:43218)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:43218 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 Tenable has extracted the preceding description block directly...

SUSE SLED15: libreoffice / libreoffice-base / libreoffice-base-drivers-firebird / etc (SUSE-SU-2026:3140-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3140-1 advisory. Update to LibreOffice 26.2.5.1. Security issues fixed: - CVE-2026-4430: out-of-bounds write via crafted OOXML...

Important: Red Hat Security Advisory: rhc-worker-playbook security, bug fix, and enhancement update

An update for rhc-worker-playbook is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-47406

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endpoints POST/GET /workspaces/workspaceid/issues/issueid/dependencies and DELETE .../dependencies/depid gate access on...

RHEL 10 : rhc-worker-playbook (RHSA-2026:42946)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:42946 advisory. A worker for yggdrasil that receives Ansible playbooks and executes them against the local host. Security Fixes: net: golang: Go net...

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Summary A Composer package declares its executables in the bin field of its composer.json. When Composer installs a package, it processes each bin entry and changes the file mode of the corresponding file so it is executable. If a bin entry contains .. path segments, it can resolve to a path...

Security update for libreoffice

This update for libreoffice fixes the following issues: Update to LibreOffice 26.2.5.1. Security issues fixed: CVE-2026-4430: out-of-bounds write via crafted OOXML documents with mismatched encryption salt parameters bsc1264357. CVE-2026-6039: denial of service via specially crafted DXF polyline...