MGASA-2026-0388 Updated thunderbird packages fix security vulnerabilities

Uninitialized memory in MIME parsing. CVE-2026-84639 One byte overflow read in mail parser. CVE-2026-84640 Information disclosure due to malicious IMAP server response. CVE-2026-84641 Calendar invitation attachments could launch local executables. CVE-2026-84637 Allowed UNC hostnames for...

RLSA-2026:65832 Important: mrtg security update

The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provide a live visual representation of this traffic. Security Fixes: mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID...

mrtg security update

An update is available for mrtg. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Multi Router Traffic Grapher MRTG monitors the traffic load on network...

DRUPAL-CONTRIB-2026-141

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorange\saml module does not correctly restrict access to certain functionality intended for administrative use. This could allow...

CVE-2026-87927

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

CVE-2026-77120

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause privilege escalation to root and unauthorized execution of administrative functions when an authenticated user with SSH enabled interacts with the operating syste...

CVE-2026-70425

Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability. An admin privileged local attacker could potentially exploit this vulnerability, leading to elevation of privileges to roo...

GHSA-7RHF-42QF-VRVC gix-sec safe.directory protections absent for elevated administrators

Summary In a process run with full administrative rights on Windows, gix-sec wrongly treats all locations as trusted, leading to the execution of commands configured in repositories controlled by limited user accounts. Details In a similar way to Git, gitoxide tries to avoid operating in local...

gix-sec safe.directory protections absent for elevated administrators

Summary In a process run with full administrative rights on Windows, gix-sec wrongly treats all locations as trusted, leading to the execution of commands configured in repositories controlled by limited user accounts. Details In a similar way to Git, gitoxide tries to avoid operating in local...

CVE-2026-77120

CVE-2026-77120 is an OS Command Injection vulnerability (CWE-78) in a Schneider Electric product. When an authenticated user with SSH enabled interacts with the operating system console that improperly processes user-controlled input, it can lead to privilege escalation to root and unauthorized e...

CVE-2026-77120

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause privilege escalation to root and unauthorized execution of administrative functions when an authenticated user with SSH enabled interacts with the operating syste...

EUVD-2026-75107

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause privilege escalation to root and unauthorized execution of administrative functions when an authenticated user with SSH enabled interacts with the operating syste...

CVE-2026-68484

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges...

CVE-2026-70425

Dell PowerScale OneFS versions 9.5.0.0–9.7.1.0, 9.8.0.0–9.10.1.0, and 9.11.0.0–9.14.0.1 are affected by a command injection vulnerability. A locally authenticated attacker with admin privileges can exploit it to escalate to root , impacting confidentiality, integrity, and availability. The CVSS 3...

EUVD-2026-75096

Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability. An admin privileged local attacker could potentially exploit this vulnerability, leading to elevation of privileges to roo...

CVE-2026-70425

Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability. An admin privileged local attacker could potentially exploit this vulnerability, leading to elevation of privileges to roo...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco's Secure Firewall Management Center FMC Software. First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco's Secure FMC Software, which allows an unauthenticated, remote attack...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...