PT-2026-83666

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

PT-2026-83644

Origin Validation Error vulnerability in ash-project ash ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowed origins: nil, origin...

PT-2026-89728

This update for libgpg-error fixes the following issue: - Out-of-bounds read in gpgrt vfnameconcat of stringutils.c when the GPGRT FCONCAT SYSCONF flag is used bsc1263078...

Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

CVE-2026-82811: Origin Validation Error

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

PT-2026-89355

This update for libgpg-error fixes the following issue: - Out-of-bounds read in gpgrt vfnameconcat of stringutils.c when the GPGRT FCONCAT SYSCONF flag is used bsc1263078...

PT-2026-83691

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When...

PT-2026-102987

This update for libgpg-error fixes the following issue: - Out-of-bounds read in gpgrt vfnameconcat of stringutils.c when the GPGRT FCONCAT SYSCONF flag is used bsc1263078...

RHEL 8 : xmlrpc-c (RHSA-2026:61236)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61236 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

Linux Distros Unpatched Vulnerability : CVE-2026-80687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommufd/viommu: Release the igroup lock on the vdevicesize error path iommufdvdeviceallocioctl takes idev-igroup-lock, then validates the driver's vdevicesize...

RHEL 9 : xmlrpc-c (RHSA-2026:61231)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61231 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

Linux Distros Unpatched Vulnerability : CVE-2026-80620

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Revert PCI/MSI: Unmap MSI-X region on error This reverts commit...

RHEL 9 : xmlrpc-c (RHSA-2026:61232)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61232 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

RHEL 9 : xmlrpc-c (RHSA-2026:61315)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61315 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

RHEL 8 : xmlrpc-c (RHSA-2026:61233)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61233 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

PT-2026-83669

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash ai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

Skia Graphic Library Confidential Data Access

The vulnerability of the Skia graphic library in Google Chrome and Microsoft Edge is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

WebKitGTK buffer error vulnerability

WebKitGTK has a buffer error vulnerability stemming from improper memory handling; processing malicious web content may lead to memory corruption...

CVE-2026-81315: Origin Validation Error

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

ALSA-2026:61766 Moderate: glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: buffer over-read in...