CVE-2026-69152

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

UBUNTU-CVE-2026-68945

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: spire1.15: spire1.15-1.15.2-0.4.hum1 aarch64, x8664 spire1.15-agent-1.15.2-0.4.hum1 aarch64, x8664 spire1.15-oidc-discovery-provider-1.15.2-0.4.hum1 aarch64, x8664 spire1.15-server-1.15.2-0.4.hum...

CVE-2026-69153

CVE-2026-69153 (PostCSS) affects PostCSS prior to 8.5.19. If the option from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL, exposing the map’s sources and sourcesContent. The issue is f...

CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: spire1.14: spire1.14-1.14.7-0.4.hum1 aarch64, x8664 spire1.14-agent-1.14.7-0.4.hum1 aarch64, x8664 spire1.14-oidc-discovery-provider-1.14.7-0.4.hum1 aarch64, x8664 spire1.14-server-1.14.7-0.4.hum...

Important: Red Hat Security Advisory: delve security, bug fix, and enhancement update

An update for delve is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

Moderate: Red Hat Security Advisory: p11-kit security update

An update for p11-kit is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-69088

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

RLSA-2026:47178 Important: yelp security update

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. Security Fixes: yelp: yelp-xsl: Overly Permissive Content Security Policy i...

Security update for bind

This update for bind fixes the following issues: CVE-2026-10723: accepting incorrect child-zone NSEC3 records as valid can allow an attacker to forge authenticated NXDOMAIN responses for sibling zones bsc1271982. CVE-2026-10822: storing a DNS key record with an invalid PRIVATEDNS algorithm...

RHSA-2026:49525 Red Hat Security Advisory: perl-Archive-Tar security update

Bulletin has no description...

EUVD-2026-52257

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library that could lead to HTTP request smuggling, desynchronization, or RTSP request injection.(CVE-2026-41417).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. A vulnerability in netty could allow an attacker to inject malicious CRLF sequences into request URIs, resulting in HTTP request smuggling, protocol desynchronization, and the execution of unintended HTTP ...

CVE-2026-18590 Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function setsysadm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service (DoS) flaw (CVE-2024-26308, CVE-2024-25710)

Summary IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service DoS flaw. All those libraries have been upgraded and this issue has been addressed in this release. Vulnerability Details CVEID:CVE-2024-26308...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the IETFUtils.valueToString method, reached through X500Name.toString, equals, and hashCode via AbstractX500NameStyle, which escapes each special character with vBuf.insertindex, "\" on the same...

ROOT-OS-DEBIAN-13-CVE-2026-23321 CVE-2026-23321 in rootio-linux - Patched by Root

Root has patched CVE-2026-23321 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection in the parseDN method of the JDK 1.4 LDAPStoreHelper class, which returns the raw DN component that callers concatenate into an LDAP filter of the form attr=value and pass to DirContext.search without the filterEncode...