CVE-2026-97182 halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization

A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper...

CVE-2026-97182

A security vulnerability exists in halo-dev Halo versions up to 2.25.4/2.26.1 . The flaw is located within an unknown function in the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java belonging to the SpEL Handler component. This issue leads to i...

CVE-2026-97182: Improper Neutralization

A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper...

PT-2026-97890

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tegra vip channel of parse function where the np variable is initialized from dev-of node without taking a reference. When endpoint parsing fails due to a malforme...

PT-2026-97790

A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper...

Linux Distros Unpatched Vulnerability : CVE-2026-88339

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference vulnerability exists in the gfsgvrmlfieldclone function of GPAC 2d7da22e 26.08-DEV. The vulnerability occurs when cloning a PROTO...

VulnCheck KEV: CVE-2026-30633

Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the getdoc and updatedoc tools...

PT-2026-97982

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vhost-scsi component where guest response descriptors are translated into userspace iovecs during command submission. Because target-core completes these commands...

CVE-2026-88339

A NULL pointer dereference vulnerability exists in the gfsgvrmlfieldclone function of GPAC 2d7da22e 26.08-DEV. The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition,...

CVE-2026-88339: NULL Pointer Dereference

A NULL pointer dereference vulnerability exists in the gfsgvrmlfieldclone function of GPAC 2d7da22e 26.08-DEV. The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition,...

CLSA-2026-1790004677 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 5.2.2-tuxcare.2...

webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...

GHSA-P5VG-V7MJ-F6Q4 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials

Summary frain-dev/convoy all versions up to and including v26.6.2, no patch available lets any authenticated caller who is authorized on at least one project read ANY OTHER project's "Source" record by ID via GET /api/v1/projects/projectID/sources/sourceID -- regardless of whether that Source...

CLSA-2026-1789721764 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 1.11.0-tuxcare.1...

SUSE CVE-2026-90071

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it when that transmit fails. The skb then walks on to the next slave...

Linux Distros Unpatched Vulnerability : CVE-2026-90071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it...

Linux Distros Unpatched Vulnerability : CVE-2026-90187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.1 Release.

Red Hat OpenShift Dev Spaces 3.30.1 has been released. The 3.30.1 release fixes the regression CRW-13015 Get Started / sample cards on the dashboard are empty after upgrade to 3.30. This release provides additional CVE fixes and container dependency updates to Dev Spaces 3.30. Red Hat OpenShift D...

Security Bulletin: Vulnerability in DOMPurify affects DB2 Dev Extension (CVE-2026-0540, CVE-2026-41238, CVE-2026-41239, CVE-2026-41240)

Summary Upgraded dompurify to 3.4.0 to remediate CVE-2026-0540, CVE-2026-41238, CVE-2026-41239, and CVE-2026-41240 CWE-79: Cross-site Scripting — highest CVSS Base Score 6.9 Medium — PVR0810799. Vulnerability Details CVEID:CVE-2026-0540 DESCRIPTION: DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through...

Security Bulletin: Vulnerability in Spring Framework affects DB2 Dev Extension (CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846)

Summary Upgraded spring-webmvc to 6.2.19 to remediate CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, and CVE-2026-41846 Information Disclosure, DoS, Path Traversal, Open Redirect, XSS — highest CVSS Base Score 7.5 High — PVR0786341. Vulnerability Details CVEID:CVE-2026-41841...