Moderate: Red Hat Security Advisory: glib2 security update

An update for glib2 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundar...

glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundar...

CVE-2026-87529

Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87460

An use after free flaw was found in the Platform component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=540058837...

SUSE CVE-2026-54754

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

SUSE CVE-2026-55763

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay royaltiesToPay, so a valid PercentTransferPercentage = 10000 split...

EUVD-2026-74410

Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87529: Numeric Truncation Error

Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Microsoft Azure Entra ID OAuth Device Code Grant Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Azure. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OAuth Device Code Grant endpoint. The issue results from the generation of...

CVE-2023-54396: Improper Validation of Array Index

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server...

CVE-2026-54048: Server-Side Request Forgery (SSRF)

Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...

CVE-2026-87563: Origin Validation Error

Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

ROS-20260909-73-0168

The vulnerability of the StorageAccessAPI component in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability can allow an attacker to manipulate data integrity through a specially created HTML page...

ROS-20260909-73-0034

The vulnerability in Chromium is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to cause a service failure...

MiracleLinux 8 : xmlrpc-c-1.51.0-11.el8_10.1 (AXSA:2026-1789:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1789:02 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from t...

RockyLinux 8 : xmlrpc-c (RLSA-2026:64772)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:64772 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from the...

PT-2026-102373

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x Description The PyJWS. load function in jwt/api jws.py fails to catch RecursionError when processing a deeply nested token header via json.loads. Because the parser only catches ValueError, the RecursionErr...

RHEL 9 : glib2 (RHSA-2026:65770)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65770 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

Linux kernel Heap Buffer Overflow DoS

The vulnerability in the dotracebtrfssyncfile function within the include/trace/events/btrfs.h module of the Linux kernel operating system is related to synchronization errors when using a shared resource. Exploitation of this vulnerability may allow an attacker to cause a denial of service...